Systems and methods of secure data exchange

ABSTRACT

An example method for managing digital rights management (DRM) protected content sharing in a networked secure collaborative computer data exchange environment includes establishing, by a secure exchange facility and managed by an intermediate organizational entity, a procedure that allows a user from a first entity to share access to computer data content with a user from a second entity based on indicated access rights. The method includes transforming the computer data content into DRM protected content, utilizing a DRM engine provided by a separate entity. The method includes granting access to the content to the second user, providing permissioned control to entities utilizing a number of data storage nodes, and managing secure data exchange of the content and metadata, without the secure exchange facility having access to the content. The method includes operations to support content services including data transformation, filtering, analytics, and searching tools for the content.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of the following provisionalapplications, each of which is hereby incorporated by reference in itsentirety: U.S. Patent Application Ser. No. 61/983,272 filed Apr. 23,2014, U.S. Patent Application Ser. No. 62/009,680 filed Jun. 9, 2014,U.S. Patent Application Ser. No. 62/040,171 filed Aug. 21, 2014, U.S.patent application Ser. No. 62/096,087 filed Dec. 23, 2014, U.S. PatentApplication Ser. No. 62/110,985 filed Feb. 2, 2015, and U.S. PatentApplication Ser. No. 62/130,875 filed Mar. 10, 2015.

FIELD OF THE INVENTION

The present invention relates to networked secure content, and moreparticularly to sharing, viewing, and collaboration of networked securecontent between entities.

BACKGROUND

Despite the availability of the Internet, there is still no entirelysatisfactory way for people at different companies or other entities tohave the benefits of private network security, such as for file sharingor collaborative work between enterprises on a daily basis and for adhoc alliances, i.e., different sets of entities coming together tofunction as one mega or meta entity, for the duration of some particularproject. In such cases, the time and expense of actually wiring anetwork between two or more companies or other entities and agreeing onone common software package or standard presents a barrier toconventional network solutions. In addition, any new process for thesharing of content has in the past generally required the user to adoptnew workflow components, applications, and habits that tend to bedisruptive to the user's normal day-to-day workflow routine, e.g. whenworking internal to their enterprise and with personal use. Simply usingthe Internet remains imperfectly secure for the sharing of confidentialinformation without some pre-arranged secure encryption processes hasbeen cumbersome and unproductive, especially in today's increasing useof personal devices being incorporated into the workflow. Further,secure storage and sharing of content across diverse storage facilitiesmakes it difficult to meet requirements for tracking content, such asfor maintaining the ability to access all versions of a document, to allusers with a copy of a document, and the like. For instance, withcontent shared across diverse storage facilities it may be difficult fora user or enterprise to respond to a discovery request for electroniccontent. There is a need for such systems and for users to utilize thesystems in such a way that does not force them to adopt newinfrastructure, software, and business and personal processes in theirdaily workflow in order to achieve a shared and potentially secureextended work environment.

Thus, there are still yet-unsolved problems associated with differentgroups of companies or other entities to sharing securely over anexpanding global network environment.

SUMMARY

The present disclosure describes methods and systems contributing tomanaging digital rights management (DRM) protected content sharing in anetworked secure collaborative computer data exchange environmentthrough a secure exchange facility managed by an intermediateorganizational entity amongst users of a plurality of otherorganizational entities, wherein computer data content and access rightsfor the computer data content is shared between a first and second user,and the computer data content and access rights for the computer datacontent are translated into a DRM protected computer data contentthrough communications with a DRM engine, wherein the DRM engine isselected based on a content type of the computer data content, and theDRM engine is not associated with the intermediate organizational entityor the plurality of other organizational entities.

In embodiments, a method for managing digital rights management (DRM)protected content sharing in a networked secure collaborative computerdata exchange environment includes establishing, by a secure exchangefacility managed by an intermediate organizational entity, a user logindata authentication procedure that allows a user through at least oneclient computing device to access the secure exchange facility, whereinthe user is one of a plurality of users of a plurality of otherorganizational entities that access content shared through the secureexchange facility, where communication between the secure exchangefacility and the plurality of users is through a communications network;receiving computer data content and at least one indicator of accessrights for the computer data content from a first user of the pluralityof users associated with a first organizational entity of the pluralityof other organizational entities, wherein the first user permits sharingaccess to the computer data content by at least a second user of theplurality of users associated with a second organizational entity basedon the indicated access rights, wherein the second organizational entityis one of the plurality of other organizational entities and isdifferent than the first organizational entity; transforming thecomputer data content into DRM-protected computer data content throughcommunications with a DRM engine, wherein the DRM engine is selectedbased on a content type of the computer data content, and wherein theDRM engine is provided by an entity other than the intermediateorganizational entity and other than any of the plurality of otherorganizational entities that access content shared through the secureexchange facility; and granting, by the secure exchange facility, sharedaccess to the DRM protected computer data content to at least the seconduser.

These and other systems, methods, objects, features, and advantages ofthe present invention will be apparent to those skilled in the art fromthe following detailed description of the preferred embodiment and thedrawings. All documents mentioned herein are hereby incorporated intheir entirety by reference.

BRIEF DESCRIPTION OF THE FIGURES

The invention and the following detailed description of certainembodiments thereof may be understood by reference to the followingfigures:

FIGS. 1A-1B depict a top-level block diagram of an exemplary secureexchange service.

FIG. 2 depicts functions of a host server in an embodiment of anexemplary secure exchange service.

FIG. 2A depicts additional functions of a host server in an embodimentof a secure exchange service.

FIG. 3 depicts a functional block diagram for an exemplary communityfacility in an embodiment of the present invention.

FIG. 4 depicts a functional block diagram for an exemplary amendmentvoting facility in an embodiment of the present invention.

FIG. 5 depicts a functional block diagram for an exemplary securee-signing facility in an embodiment of the present invention.

FIG. 6 depicts a functional block diagram for an exemplary dashboardfacility in an embodiment of the present invention.

FIG. 7 depicts a functional block diagram for an exemplary email-infacility in an embodiment of the present invention.

FIG. 8 depicts a functional block diagram for an exemplary viewerfacility in an embodiment of the present invention.

FIG. 9 depicts a functional block diagram for an exemplary mobile deviceinterface facility in an embodiment of the present invention.

FIG. 10 depicts a functional block diagram for an exemplary un-sharingfacility in an embodiment of the present invention.

FIG. 10A depicts an illustrative process flow diagram that in partdescribes an interaction utilizing the un-sharing facility.

FIG. 11 depicts an illustrative process flow diagram for an archivefacility.

FIG. 12 depicts a functional block diagram for an exemplary file accessfacility in an embodiment of the present invention.

FIG. 13 depicts a functional block diagram for an exemplary spreadsheetviewer facility in an embodiment of the present invention.

FIG. 13A depicts a functional block diagram for an exemplary spreadsheetviewer facility in an alternate embodiment of the present invention.

FIG. 14 depicts a functional block diagram for an exemplary emaileffectivity facility in an embodiment of the present invention.

FIG. 14A depicts a functional block diagram for an exemplary emaileffectivity facility in an embodiment of the present invention, showinga case where an identical email address does not have entitlement to adata file.

FIG. 15 depicts a functional block diagram for an exemplary virtualcontainer DRM facility in an embodiment of the present invention.

FIG. 16 depicts an exemplary electronic discovery facility incommunication with a content storage service that is network-based.

FIG. 17 is an illustration of an exemplary secure data exchange system.

FIGS. 18-30 depict various aspects and features of an exemplarycustomizable secure exchange system/platform/architecture/environment.

FIGS. 31A-31C depict a non-limiting embodiment of a cloud-computingimplementation of the data management facility.

FIGS. 32A-32C depict a non-limiting embodiment of a cloud-computingimplementation of the data storage node.

FIGS. 33A-33D depict a representative optional rack configuration for adata storage node.

FIGS. 34A-34B illustrate an exemplary secure data exchange environment.

FIG. 35 is a block diagram illustrating a digital rights management(DRM), or Information Rights Management (IRM) according to at least oneexample embodiment.

FIG. 36 is a signaling flowchart illustrating communications betweendifferent entities of a DRM system during a publishing phase, accordingto at least one example embodiment.

FIG. 37 is a signaling flowchart illustrating communications betweendifferent entities of a DRM system during a consumption phase, accordingto at least one example embodiment.

FIG. 38 depicts an embodiment of a federated access facility for accessacross heterogeneous content repositories.

FIG. 39 depicts comparison of a document encryption process with andwithout customer managed keys.

FIG. 40 depicts an embodiment sequence diagram showing process stepsassociated with customer managed keys. This type of diagram is oftencalled a “Sequence Diagram.” It shows the systems involved and thecommunications between such systems.

FIG. 41 depicts an embodiment top-level diagram showing how a user isprovided direct access to manage their keys.

FIG. 42 depicts a functional block diagram for a workflow managementworkspace.

FIG. 43 depicts a functional block diagram for a secure mobile deviceenvironment.

FIG. 44 depicts a functional block diagram for a contextual sharingfacility.

FIG. 45 depicts a functional block diagram for a sworn documents sharingfacility.

FIG. 46 depicts a workflow diagram for transport and provisioning in asworn documents sharing facility.

FIG. 47 depicts a workflow diagram for extraction in a sworn documentssharing facility.

FIGS. 48A-B, 49A-B, 50, 51A-B, and 52 depict DRM authentication serviceflow diagrams.

FIG. 53 depicts an embodiment diagram showing key management in a securecontent environment.

FIG. 54 depicts an embodiment workflow diagram for end-to-endencryption.

While the invention has been described in connection with certainpreferred embodiments, other embodiments would be understood by one ofordinary skill in the art and are encompassed herein.

All documents referenced herein are hereby incorporated by reference.

DETAILED DESCRIPTION

Secure Exchange System

The present disclosure describes a secure exchange system (alternativelyreferred to as an ‘exchange’, ‘exchange platform’, ‘exchange service’ or‘data exchange system’ throughout this disclosure) where many types ofcommunications are required between different parties that areassociating for a temporary transaction or project, but as competitorsor for other reasons are not suitable for a permanent communicationnetwork (such as an intranet or enterprise network, such as a LAN orWAN) as might be used for a single government agency, singlecorporation, or other single enterprise or institution. Transactionprojects involving financial transactions and projects involving complexlegal agreements (such as mergers, acquisitions, and the like) aresituations in the which the methods and systems described herein areparticularly suitable; however, these are not necessarily the only sortof projects appropriate, as any project in which parties need to shareconfidential information across entities, outside the boundaries of thenetwork of a single entity, may benefit from the methods and systemsdescribed herein, including litigation or other disputes. Inembodiments, the secure exchange system may be implemented as a large,multi-tenant, enterprise-scalable, global orchestration of work, such asorganized into work streams with work products, where the secureexchange system is hosted by an intermediate organizational entityaccessible by a plurality of other independent organizational entities.

In an example, transactions within the banking industry may provide asituation where a secure exchange service may be particularlyapplicable, where ad hoc syndicates are formed under the leadership ofone or more lead banks to permit a number of agent or associate banks toparticipate in a major loan to a borrower. Such loans have become morecommon and may involve loans in excess of one billion dollars.Syndication of such large loans is used since any one bank is notprepared to lend such a large amount to a single customer.Conventionally, proposed terms of a loan are negotiated between theborrower and the lead banks, each in consultation with its advisors suchas legal counsel, public-relations consultants, accountants andinsurance carriers. In some instances, some advisors may be in-houseadvisors as employees of a given entity and thus constitute an internalteam. However, the advisors in many instances may be independentlyassociated with external entities such as law firms or major accountingfirms, and thus constitute either external teams or combinations of theabove. The lead bank(s) negotiates with the borrower to arrive at termsand conditions for the loan, such as the interest rate, repaymentschedule, security and the bank's fee for processing and syndicating theloan. The lead bank may agree to underwrite the entire loan in whichcase the lead bank uses syndication to create sub-loans between it andother banks to raise the funds for the loan. All of these transactionsrequire management of voluminous amounts of documentation, most of whichis confidential and whose disclosure could result in huge damages to theborrower or lenders. Thus, it would be desirable to provide an exchangeas described herein which enables secure document transmission betweenusers over a global communication network without requiring the users tocommunicate in advance to establish an encryption method. In thisexample, the exchange service may provide a suitable level of securitywith respect to each of the shared transactions, among companies thatcommonly may be vigorous competitors, with numerous confidentialdocuments that the companies do not want uncontrollably shared amongother members of the loan-project group or accessible by outsidersgenerally. Substantially secure communications is particularly of theutmost concern to all parties to a syndicated loan transaction: theborrower, the lead bank, and the associate banks. A virtual networksystem provided through the exchange may readily provide substantialsecurity to ensure that information and communications among all thevarious parties are secure.

In embodiments, the exchange may enable electronic transmission andreception of confidential documents over a global communication networksuch as the Internet for distributing electronic documents containingsensitive information or data to selected entities, for notifyingintended recipients of the availability of such documents, for trackingaccess, downloading and uploading of such documents, and the like.

In embodiments, the exchange may only be accessed by authorizedcomputers using an acceptable log-in procedure, including user name andpassword. Communications within the exchange may establish acommunication session based upon a selected security protocol, andthereafter messages are transmitted between using such secureencryption. Communications may be exchanged via a secure encryptedcommunication session using a selected encryption protocol, and may denyaccess if a secure session cannot be established at a desired securelevel.

In embodiments, the exchange may provide a fully provisioned, turnkeyservice for users, where once the user's enterprise has established anaccount through the exchange, documents in electronic form may beuploaded to the secure site maintained through the exchange host server,where a variety of secure collaborative communications options may bechosen including document storage, e-mail, video broadcasting, videoconferencing, white boarding, and the like, to augment and manageinteractive access to the documents, including a user graphicalinterface for managing user interactions with one or more exchanges.

In embodiments, the exchange may provide one or more secure sites forplacing documents and messages to be transmitted over a secure virtualnetwork and may allow authorized users to read or edit messagesaccording to their level of authorization. Any documents that are editedmay be immediately available on the system so that other personsinvolved in the exchange have access to the edited or modified documentsimmediately. In addition, the exchange may provide tracking of eachdocument to allow selected users to see who has had access to themessages and documents and who has modified or edited any of thedocuments. Content and communications shared amongst a group may beincluded in a work stream, where the work stream may be focused on orassociated with a particular topic, task, project, event, and the like.Content and communications may also be presented to users based onactivity, thus creating an activity stream that shows users what isactive, such as in a work stream, within a group of work steams, and thelike. In this way, the activity-based work stream provides a locationwere a user might go to see what is active in one or more work streams,exchanges, and the like.

In embodiments, the exchange may provide a centralized firewall that maybe employed to protect confidential information so that no unauthorizedaccess to such information occurs. A firewall, such as may beeffectively used for corporate intranets, may be applied in eachexchange. Groups of users, such as on a virtual network, may be treatedlike a remote corporate office and restricted by firewall protocols fromuncontrollable access to the information from other users. In addition,if needed, respective inter-user firewalls may be established to preventone user from accessing information in the host site of another user.The exchange may be particularly suitable for communication amongmultiple unrelated groups of users, since a centralized firewallmanagement may simplify the logistics of each user having to separatelyprovide secure access through their own respective enterprise firewalls.In such a centralized management architecture, the host managemententity, as opposed to each respective user, may conveniently processserver access security data. Similarly, system backup and recovery maybe better handled by a centralized backup and recovery system throughthe host management entity, as opposed to such recovery tasks beingseparately handled at a multiplicity of enterprise sites.

In embodiments, a plurality of exchange service users of the secureexchange system may exchange data, such as documents, messages, data,and the like, between a secure host server and a plurality of usercomputers across a network (e.g. the Internet) in a secure manner suchas only accessed by authorized user computers using an acceptable log-inprocedure. In embodiments, the user computers may interface with thenetwork through a network server, a mail server, and the like, and inassociation with an enterprise intranet, where a firewall is presentbetween the user computer and the network, and where the exchange isconducted between the user computers and the host computer through asecure exchange across the network and through the network server, mailserver, and the like. In another embodiment, the user computers mayinteract in the exchange with the secure exchange system across thenetwork while away from or in the absence of the enterprise intranet andenterprise firewall. For instance, the user may be able to access theexchange while at home, such as using a mobile enterprise computer, apersonally owned computer, a mobile device, and the like.

In embodiments, the exchange host server may be distributed over aplurality of server computers, and therefore the host server may beviewed as one of such multiple servers. In this way, the servercomputers may work together to provide essentially seamless access to alarge number of users on various platforms with varying communicationsspeeds. The server computers may run under server management softwarewhich in turn may be responsible for coordination of services,maintaining state and system status, monitoring, security, and otheradministrative functions. In embodiments, a user computer having asuitable Web browser may directly access the host server, where theexchange may not need to provide each user with subscriber applicationsoftware, such as including software modules for access, activation,viewing, communications, and the like, relative to the exchange service.

In embodiments, whenever an exchange of data is initiated, such as by adocument being received at the host server connected to a host database,the host server may extract the address of the intended recipient andcreate a notification to the recipient(s) of the existence of the dataat the host server. The notification may contain the URL for the hostserver. However, the recipient may not be able to access the messageunless the recipient is authorized to use the system, such as therecipient needing to be a registered user and have an assigned passwordto access the data, or other repository at the host server where data isstored, such as on a user database. If the intended recipient is grantedaccess to the host server, the recipient may then locate the messageintended for them by browsing through all messages to which therecipient has been granted access.

While the notification sent to the intended recipient may be sent usingstandard Internet protocol without encryption, once the user computercontacts the host server, the server may establish a secure encryptedcommunication session using a selected encryption protocol. The hostserver may deny access if a secure session cannot be established at adesired secure level, such as 128-bit encryption.

In embodiments, exchange services for different users may utilizeseparate software structured server databases. For example, company ‘A’and company ‘B’ may use the secure exchange system, but each company'sdata may be maintained in separate databases, although perhaps in thesame physical data storage facility. This feature offers the advantageof allowing the facilities of the secure exchange system to becustomized for each company. For example, when the external useraccesses the secure exchange system, the secure exchange system mayrecognize the user and associate the user with a particular one of thecompanies A and B. Using this recognition, the secure exchange systemmay present a customized browser interface which makes the secureexchange system look like it is operated by or branded for the selectedcompany. To the external user, it may appear that they have beenconnected directly to the company server rather than the secure exchangesystem. Thus, the present invention may allow a user to securely senddata such that the network connection is substantially transparent tothe user. Further, the system may provide customization for each of aplurality of different users such that an external user accessing thesecure exchange system may appear to be connected to an internal clientserver.

In embodiments, the secure exchange system may be organized as acentrally hosted secure computer system, a distributed hosted securecomputer system, and the like, accessible by a plurality oforganizational entities. The secure exchange system may be organized asa customizable hybrid system to accommodate the needs of organizationalentities. In embodiments, data stored by the plurality of organizationalentities may be at least in part centrally stored, stored at least inpart in distributed locations, stored at least in part on the premisesof the organizational entity, and the like. FIGS. 1A and 1B depict anembodiment secure exchange system with functional elements enabling ahybrid system having available both centralized and distributed storagecapabilities, each enabled with secure exchange system capabilities. Theembodiment is not meant to be interpreted as limiting in any way, but tobe illustrative of the capabilities of the secure exchange system asdescribed more fully in this disclosure. For example, the secureexchange system may include a centralized secure exchange system 102that provides centralized management of the secure exchange of contentwith user devices 120 (including mobile devices like smart phones andtablets), on-enterprise premises 110 resources (such as enterprise filesystems, data stores, and metadata stores), and the like. The secureexchange system 102 may include a secure data management facility 104,data storage node 106, metadata storage 108, and the like, to providesecure data exchange services to the enterprise site, user devicesinside or outside the enterprise firewall, and the like.

As depicted in an embodiment in FIGS. 1A and 1B, and as described inthis disclosure, the secure exchange system may comprise a customizablesecure exchange system that is at least in part modularized, with one ormore of the modules, services and/or capabilities depicted on FIGS. 1Aand 1B being encapsulated in one or more secure envelopes (e.g., wheresecurity extends beyond a centralized hosted secure server, out into thecloud computing space, as part of an enterprise computing resourceinside the enterprise firewall, or the like), and/or provided for use tobusiness entities in a location other than the secure host server, suchas one or a combination of on-site at a business entity, on a securecloud service, on a commercial cloud service, distributed across ageographic area, in a location local to the business entity, providedthrough distributed hosting, and the like. This architecture may providea highly scalable platform upon which business process applications thatuse the data and metadata that is exchanged and stored via the secureexchange system can be built. Further, the functionality provided insecure exchange system embodiments such as described herein may bemodularized to enable the business entity to select basic services,building blocks, components, toolkits, and the like in building theirown secure collaboration and sharing facility that is adapted to meetthe needs of the business entity and its business units and users, suchfor a specific business market in which the business entity operates, aproject the business entity is working with, a partnered collaborationbetween business entities, and the like.

In embodiments, certain modules of the secure exchange system may be atleast in part located on enterprise premises 110 to provide on premisesand user device applications and services 161, such as client-sidecustomer managed keys, community facility, amendment voting, electronicsignature facility, dashboard facility, email-in facility, viewerfacility, playback of interactions, buyer interest index, mobile deviceinterface, sharing and un-sharing facilities, content access management,time-based file detection, watermarking, question and answer management,single sign-on, un-authenticated document exchange, metadatasynchronization facility, filing sharing activity, collaborationmanagement facility, geo-tagging facility, secure collaborative content,fair share queuing, location based file access, multi-factorauthorization, configurable password, client archiving, offline fileaccess, spreadsheet viewer, virtual machine and container digital rightsmanagement facility, email effectivity facility, e-discovery facility, arules-based workflow management facility, protected drive facility,virtual drive facility, revision timeline facility, collections userinterface, 3D viewing facility, metadata sharing facility, commentnotification facility, cross-enterprise collaboration facility, actionchecking, secure mobile device environment, work-stream synchronization,contextual sharing facility, study space and electronic investigatorsite files, managing access to content through digital rightsmanagement, dynamic entitlement management, key management in a securecontent environment, collaborative customer relation management, IPaddress and domain rule based access restriction, and the like. Forexample, various applications and services 130 may be provided (e.g.,various workflow applications 131 for accomplishing a wide range ofbusiness functions (e.g., human resources, accounting, research anddevelopment, product management, transaction management, and manyothers), sharing and un-sharing applications 132 as described throughoutthis disclosure, user interface applications (such as a flexible userinterface 134 and/or a secure viewer 133 or other interface as describedelsewhere in this disclosure), application server functionality 135,instant applications 136 as described elsewhere in this disclosure, anda wide range of other applications and services of the type typicallyused by a business entity).

In the embodiment depicted in FIGS. 1A and 1B, a range of interfaces 162(which may include various bindings 164 and messaging 163 capabilities)each may be adapted to enable exchange of messages, data, metadata andthe like with a particular service, engine, module, function,application or the like on the enterprise premises system 110, at theintermediate host's secure exchange system 102, on a user device 120, byorchestration services 165, or in some other location, such as in acloud storage system 118. The interfaces 160 may include applicationprogramming interfaces (APIs), such as REST APIs, websocket APIs, APIsfor wrappers and containers and the like, as well as other elements,such as queue binding services, message brokers, bridges, gateways,sockets and the like.

Among other things, the interfaces allow secure interfacing withorchestration services 165 as described in more detail elsewhere in thisdisclosure, which, among other things, allow the secure exchange systemto enable, orchestrate, track and report on activities of users ofvarious business entities involving secure exchange of data among them,without the need for the host of the secure exchange system to haveaccess to the data itself. These orchestration services 165 may include,for example, identity management services 174, search services(including federated search services 176 across various data storeslocated on premises, in the cloud, at the host and on user devices asdescribed in more detail elsewhere in this disclosure), workflowmanagement services 177, asset and entitlement management services 178(including key management services), paradata services 179, analyticsservices 180, and the like. The orchestration services 165 may alsoinclude various composite services 175, such as ones that areconstructed using other services or components thereof. Theorchestration services 165 may include a service manager 112B, which mayinteract with a similar service manager 112A located in the onenterprise premises system 110, as well as with capabilities andservices of the secure exchange system 102, to deploy, track, manage,and report on the activities of one or more of the services,applications, engines and the like described herein.

The intermediate host's secure exchange system 102 may also includevarious exchange services, such as a hosted secure data managementfacility 104 as described throughout this disclosure, with data storagenodes 106 and metadata storage nodes 108, functionality to support acustomizable secure exchange system, functionality to support federatedaccess across heterogeneous content repositories, secure exchange ofcustomer managed keys, single sign-on, archive facility, multi-factorauthorization, configurable password facilities, archiving services,offline file access facilities, rules-based workflow managementfacility, investor portal, encryption services, cross-enterprisecollaboration facility, work-stream synchronization, study space andelectronic investigator site files, secure enterprise content portal,digital rights management services, key management in a secure contentenvironment, collaborative customer relation management, API wrappersupport, end-to-end encryption protection, and the like, as described inthis disclosure, where FIGS. 1A-1B are intended to encompass the rangeof deployments of such capabilities, whether on premise, on a the secureexchange server, on a client device (e.g., mobile), and/or viaorchestration services. The secure exchange system 102 may be deployedalone, or it may be deployed in a hybrid situation with theorchestration services 165. The intermediate host may also manage theorchestration services 165, such as by the service manager 112B and/orby interacting with various interfaces or APIs of the orchestrationservices 165 that are designed to enable use of the various services,modules, functions and applications thereof.

The orchestration services may include various data stores that may beused by or in connection with uses of the orchestration services 165 forexchange services and storage 166, such as a workflow queue and instancestore 182 and related storage 185, an asset assertion store 183 andrelated storage 186, a paradata store 184 and related storage 187,various directories 188, and the like. Each module or set of servicesand its related store/storage system may have associated bindings173A-E, 181A-E and message services 170, 171, 172 that enable secureexchange of data with other modules, services and store/storage systems,as well as within the particular module, service set or store/storagesystem, such as enabling extraction of data, transformation of data toappropriate protocols or formats, and loading of data. For a given user,some secure data exchanges may be undertaken with data hosted on datastorage nodes 106 of the intermediate host's secure exchange system 102,while other data exchanges, such as of particularly sensitiveinformation, may be exchanged using orchestration services 165 in amanner that does not allow the intermediate host to have access to thedata; that is, the capabilities of FIGS. 1A and 1B can be deployed as ahybrid secure exchange system that may include, for example, bothcentralized (for some data) and distributed (for other data) secureexchange functionality.

On enterprise premises 110 facilities may include on premises storage(e.g., file storage in databases 142, on servers, in logs, in filesystems, on local devices and the like that are in locations of theenterprise, as well as metadata storage 140/144, analytics storage 143,and the like). Connections may be provided, either through variousinterfaces and APIs, or through bindings, to outside storage, such as tocloud data storage 118 resources (including public and private clouds),and to more general resources, such as accessible through search engines116. The on enterprise premises system 110 may include various bindingsthat allow services (such as a federated search service 151 and afederated data storage services 152) to access underlying storageresources. These may include search engine bindings 146, cloud storagebindings 147, metadata store bindings 148, file data store bindings 149,and the like. An analytics engine 145 may be used to track, record, andreport on the uses and activities of the various services, modules,engines, applications and the like of the on enterprise premises system110 to provide analytics 153 through analytics engine binding 150. Theon enterprise premises system 110 may include transformation andfiltering services 154 as described elsewhere in this disclosure, suchas for handling necessary data transformations that are needed to accessparticular systems within the enterprise, including, without limitation,systems that may use proprietary data protocols or formats of theparticular enterprise. The on enterprise premises system 110 may includekey management services 155, such as enabling the enterprise and/orindividual users to manage encryption keys used to secure and accesscontent, as described in more detail elsewhere in this disclosure.

In embodiments, transformation and filtering services 154 may provideprocessing that is done on a file or other asset, such as when thatasset is uploaded to or downloaded from a secure exchange environment.These transformation and filtering services may perform variousfunctions, including security related activities, as well as any otherprocessing that is defined for a specific asset type within a specificcontainer. These transformation and filtering services may becontainer-specific, application-specific, customer-specific, and thelike, or they may comprise general platform processing activities thatare defined in the asset workflow. Example file transformation andfiltering activities may include virus scanning, publishing, searchindexing, document encryption, bulk download (e.g., zip),transformations from one document type to another (e.g., Microsoft®Office® to .pdf), application of DRM, file chunking, web applicationprocessing, unique file naming per folder, field validation (e.g., forbusiness fields), and the like. In embodiments, customer-specifictransforms may be provided. For example, the secure exchange facilitymay provide transforms such as virus scanning, converting a document toa different format (e.g., to a PDF), and providing application-specifictransforms prior to the system applying customer-specific transformsbefore the secure exchange facility publishes a document. Similarly,customer-specific filters may be provided, such as after the secureexchange facility provides filter services for application of awatermark, application of DRM encryption, and application-specificfilters or transforms, optionally before a document is downloaded to auser.

User devices 120 may interact with the other systems depicted on FIGS.1A and 1B and with other systems and resources described throughout thisdisclosure. For example, a user device 120 may include a secure viewer122 as described in more detail elsewhere in this disclosure, by which auser may have access to data in various parts of the on enterprisepremises system 110, such access being managed by the secure exchangesystem 102 and/or the orchestration services 165 in various embodiments,such as to confirm the identity of the user of a user device 120, toconfirm the authorization of the user and device to access particulardata, to limit viewing to situations in which it is permitted (e.g.,when the user is alone, when the user in in a permitted location, andthe like), to cease access to certain content (such as by un-sharing),and the like. The user device 120 may also include a local store 124,which may be managed and accessed by the secure exchange system 102and/or the orchestration services 165 and may be accessed by a federatedsearch engine of the on enterprise premises system 110, the secureexchange system 102 and/or the orchestration services 165, such as beingincluded in a federated search that allows a user to search alldifferent stores (on premises, cloud, hosted and on local devices) witha single search.

The on enterprise premises 110 facilities may have connectivity withexternal search engines 116 and associated search engine storage 114,where search results may then be associated with internal facilitiesthrough a search engine binding. Metadata, file data, analytics, clouddata storage, and the like may be similarly bound, such as throughbinding to federated search services, federated storage services,analytics, and the like. On premises and user device applications andservices may be interfaced and bound with orchestration applications andservices through a messaging layer, such as through SMTP, SMS, and thelike. In addition, as described in this disclosure, key managementservices 155 may be provided on enterprise premises, such as to providethe enterprise side of a customer managed key arrangement.

FIGS. 2 and 2A show further details in connection with the functionalitythat may be readily incorporated in the secure exchange system 102,including a community facility 202, amendment voting facility 204,e-signing facility 208, dashboard facility 210, email-in facility 212,viewer facility 214, mobile device interface facility 218, networkservice facility 220, distribution facility 222, interface facility 224,format conversion facility 228, sign-on facility 230, encryptionfacility 232, usage facility 234, syndication facility 238, transactionidentification facility 240, link facility 242, user authorizationfacility 244, authorized reader facility 248, authorized editor facility250, notarization facility 252, multimedia facility 254, commentfacility 258, email facility 260, question and answer managementfacility 262, single sign-on facility 264, un-authorized documentexchange facility 268, synchronization facility 270, file sharingactivity facility 272, collaboration management facility 274,geo-tagging facility 278, archive facility 280, collaborative contentfacility 282, fair share queuing facility 284, offline file accessfacility 288, location-based file access facility 290, spreadsheetviewer facility 292, email effectivity facility 294, cross-enterprisefacility 298, multi-factor authentication facility 201, configurablepassword facility 203, client archiving facility 205, client key hostingfacility 207, and a virtual container DRM facility 209. Additionally,the server software may include a e-discovery facility 211, aninteractions playback facility 213, a time-delay file deletion facility215, a watermarking facility 217, a rules-based workflow facility 219, adelivery of service facility 221, a protected drive facility 223, avirtual drive facility 225, a revision timeline facility 227, a 3Dviewing facility 229, a metadata sharing facility 231, a secure storagefacility 233, and a comment notify facility 235, a dynamic entitlementfacility 239, an action checking facility 241, a secure mobile devicefacility 243, a workstream synchronization facility 247, a contextualsharing facility 249, a content access management facility 251, and asecure enterprise content portal 255.

For example, the distribution facility 222 may allow the host server toelectronically distribute data using secure communications among theplurality of users. The usage facility 234 may allow the host server tomonitor the usage of the network to permit the users to be billed forthe network service. The host server may be set up to manage a pluralityof separate virtual networks concurrently, with each such virtualnetwork representing a different client, such as company A and companyB. Further, a community facility 202 may provide for users of differentcompanies to be exposed to one other even if the different companieshave not had any previous contacts (e.g. through a shared exchange), anda dashboard facility 210 may provide companies the ability to manageexchanges, documents, contacts, communications, preferences, and thelike.

The host server may offer a high level of security for all data byemploying substantially secure network connections, and by means ofsecurity and encryption technologies developed for networks such as maybe readily incorporated in the encryption facility 232. Additionally,the host server may provide highly secure access control by way of theuser authorization facility 244 that may allow only authorized personnelto access individual messages and related documents and communications.The viewer facility 214 may be able to protect documents fromunauthorized viewing, printing, saving, and the like, and a mobiledevice interface facility 218 may enable secure viewing on a mobiledevice, such as a personal tablet being used away from an enterprisenetwork. The Email-in facility 212 may provide for the ability to addcontent to an exchange using regular email, such as that is sent to adesignated secure email address.

The host server may give each user the ability to electronically link orbe interconnected via a link facility 242 with any number of otherusers. Although data may be preferably formatted in a particular form,such as may be readily implemented with a commercially availabledocument exchange program, other formats could be optionallyaccommodated using a suitable format conversion facility 228. Themultimedia facility 254 may also be used to process data into a formatsuitable for presentation to the user in forms other than text, such asaudio, still or moving images, and the like.

The virtual-network viewer may also include a multimedia viewer facilityconfigured to, for example, provide: viewing of interactive multimediaor mixed media memoranda through suitable decoders, such as audiodecoders, Joint Photographic Experts Group (JPEG) still image decoders,and Moving Pictures Experts Group (MPEG) moving image decoders. Thevirtual-network viewer may also support various collaborativecommunications options such as e-mail, video conferencing and whiteboarding which are enabled for a given transaction pursuant toinstructions from the appropriate user. Of course, the range ofmultimedia capability and the collaborative communications options mayvary depending on the various groupware facilities available to theuser.

The notarization facility 252 may be provided to electronically certifyany electronic data forwarded to users, such as incorporating electronicsignature technology, and the like. The network service facility 220 mayconveniently be used to display various data in connection with thenetwork service such as additional services that may be available by thenetwork service to the users. The above facilities may work jointly withthe email facility 260, the interface facility 224, and the like, tosend notices of data for exchange and interface with to securely passdata.

A virtual-network viewer or browser may conveniently provide the enduser with an easy-to-use graphical interface to data and otherparticularly confidential information on the network service'svirtual-network service. The virtual-network service may provideidentification of services available over the virtual network as well asa variety of options for accessing and retrieving data. Thevirtual-network viewer may include the transaction identificationfacility 240 that, for example, may enable a user to quickly find andaccess information. The virtual-network viewer may automatically providea suitable connection to the user to the virtual-network service throughthe sign-on facility 230. The viewer may also prompt the user to inputone or more passwords or identifications which should be recognized byeither the authorized editor facility 250 or the authorized readerfacility 248 in order to access information on a database.

For the convenience of the users, some data offered through thevirtual-network service may be designed as interactive multimediadocuments that will include video, graphics, audio, and other multimediaelements. Multimedia communications may provide the user with a widevariety of information in addition to that provided by more standardtext data.

By way of an example, a syndication desk, i.e., one or more individualsauthorized to be responsible for the management of a syndicatedtransaction, of a lead user may be able to broadcast and/or selectivelysend e-mail messages processed by the syndication facility 238 toassociate users and vice-versa. For example, amendment data processed bythe amendment voting facility 204 may be used to vote on changes to atransaction document amongst authorized users. The amended document maybe conveniently distributed via email using the e-mail facility 260 forproviding associate users with up-to-the-minute information about thetransaction. Amendments or messages may be appended to the document atthe host site of the network service where they may be ordinarily viewedby accessing the virtual-network service that is authorized to accessthe document. E-mail messages or amendments may also be downloaded forprinting or for attachment to local documents. Similarly, comment datain connection with a transaction may be processed through the commentfacility 258 for appropriate distribution to authorized users.Transaction documents may also be signed by authorized users through thee-signing facility 208.

Secure Cloud Architecture with Meshed Data Centers and VariousEnterprise Clouds

In embodiments, the secure exchange server may utilize a secure cloudarchitecture with meshed data centers, various enterprise clouds,private clouds, hosted clouds, and the like. For instance, data centersin a meshed configuration may support the methods and systems disclosedherein in a secure cloud, where each of the node entities in a meshconfiguration is always or nearly always up and running Enterprisesworking in association with the secure exchange server may have theirenterprise clouds linked to a secure cloud associated with the secureexchange server. For instance, each entity may run a core platform, acontent router, an identity federator for identities associated with theenterprise, applications, code, and the like. In embodiments, the secureexchange server may connect with partner enterprise data centers, andrun an image of the same configuration, or a subset thereof, on one moresuch data centers or on one or more clouds.

Limited Content Repositories

In embodiments, there may be limited content repositories, such as wheredistribution centers, separate from the main content repositories of anenterprise, provide content access interfaces, such as content playersfor running, playing, or otherwise providing access to a limited set ofthe content associated with an enterprise, a project, or the like. Inembodiments, routing among repository elements may enable a party incontrol of content to allow multi-tenant access to any set or subset ofcontent, such as enabling multi-tenant collaborations for various workstreams that require access to content. For instance, a user interfacemay include a dashboard of work streams, one or more of which could behosted on a secure cloud infrastructure, or on a specific data center,based on the choice of the party controlling the work stream orcontrolling the content used in connection with the work stream. Inembodiments, for a given work stream, a user may connect to the closestdata center in a meshed environment with at least partial contentreplication, so a user can get access to the data center (e.g.,federated or replicated for at least certain content) that provides thehighest quality of service (e.g., bandwidth, response time, etc.) foraccess to the relevant content by the particular user. To maintaineffective mirroring of content in a timely manner for particularcontent, synchronization (such as for content and ID management) may bedefined at a plurality of levels. In an example, a system platform mayinclude ID management, collections, analytics, a composite layer, andthe like.

In embodiments, the platform may be replicated for distribution (e.g.,by sale, lease, or the like) to a number of data centers. The platformmay have a link to applications and stores, where applications mayaccess stores through or in compliance with a policy. A store may beviewed as an application and may reside in a plurality of locations,such as locally, in a data center, public cloud, private cloud, laptop,domain, and the like. A policy access layer may determine access, suchas to a specified set of applications being granted access to aspecified set of stores based on a policy. One store may be a locationstore, where the location store has identifying information as to whatcontent exists and the location where particular content is stored. Thesystem may provide for caching, such as a way for users to allow thesystem to cache content for access based on the policy. In this way, theplatform may be viewed as a service infrastructure layer. These servicesmay be in common across different storage types, so that users are ableto exchange content even though the content resides in multipledifferent data centers, clouds, or other content repositories. Inembodiments, the platform itself could be an appliance that is installedon an enterprise premises or connected through an open port. A usescenario may include a data protection compliance process workflowapplication, such as where a user needs to navigate data protection lawsand is able to change where data is hosted to meet changing dataprotection laws. For instance, in some embodiments a policy may beimplemented which specifies that unless certain data is hosted inSingapore, the system will block access to that data. In anotherembodiment, the data stores for an enterprise, wherever they reside (onpremises in data centers, in public clouds, in private clouds, ondevices, and the like) may be provided via a services layer with auditand access history, so that all such stores have a common point ofcontent access, with associated logging and audit capability, for allcontent access for the entire enterprise. Audit history may provide theability to know where the data resided at any time, as well as whoaccessed it, for all content that is stored for any purpose associatedwith the enterprise, regardless of the type of store (cloud, datacenter, individual device), the location of the same, or the type ofcontent that is accessed. Thus, methods and systems provided hereinenable universal auditing of content access across all content of anenterprise.

Community Facility

Referring to FIG. 3, the community facility 202 may provide community,social, and the like facilities, as part of the system, such as to beable to expand a user's contacts list through exposure to other userswho use or are otherwise associated with the facilities and moregenerally to make it easier for users to find and connect with otherusers who may have mutual interests. The community facility 202 mayallow community users 302, such as the plurality of exchange serviceusers 110 and plurality of other community users 304, to find oneanother using industry-specific profiles, such as provided by a profilemanager 308, to find other community users, invite users to communicateby sending invitations through a communications manager 310, see statusof invitation that have been sent or received, and the like. Through acommunity user interface 312 and associated profile manager 308,communications manager 310, and profile search facility 314, thecommunity facility 202 may provide the user with a larger visibility tothe plurality of users in the system, allow them to declare how theywant to be viewed, control whether they want to be viewed, determinewhether they can participate or not, enable them to be anonymous (e.g.profile only), allow them to be fully visible to other users, allow themto be available to users within just a particular industry, and thelike. If a user is in a particular industry, they may be able to view abasic description of that community, as well as to other industries thatthe user determines to be beneficial. The system may be provided aprofile window in the community user interface 312 that is set up basedon industry or technical specifications, such as for private equity,M&A, finance, legal, and the like. There may be a variety of differenttypes of user profiles available, such as, in connection withtransactions, a buyer side, an investor side, an advisor side, an expertside, a seller side, and the like. The community user interface 312 mayprovide a user set up through a step-through process wizard, where theuser selects industries, subsets of industries, and the like. Users maybe as specific or as general as they wish, and position themselves inthe community as seeking opportunities, presenting opportunities,presenting themselves as an expert to be called on to facilitate, andthe like. The system may provide for location information, specify adeal type, specify a deal size, and the like, to help people who aresearching for these profiles. The user may be able to uploadattachments, examples, and the like. A visibility setting may beprovided, such as available to community members, where the user isoptionally able to remain anonymous. If the user chooses to not beanonymous then they may be visible to users immediately, but stillprotected in the system. In an example, a user may be a “buyer” and an“advisor”, where they can see their own profile or sub-profile, edit thesub-profile, add another profile, and the like.

In embodiments, the community facility 202 may provide for searchcapabilities through the profile search facility 314, such as starting anew search, saving searches, saving the history of a search, and thelike, to begin interacting with the profiles of users. The searcher maybe able to search by a particular industry, investors, deal size, dealtype, geography, type of profile and the like. The user may begin asearch and generate results including the sub-profiles in the systemthat matched the search criteria. In addition, there may be a variety ofvisibility levels associated with the searches. For example, a searchmay return three matches but where one match is a user that is ananonymous user. In this instance, information may be withheld as tospecifics, but with the ability to see more general profile attributes,such as a user's title. There may also be search indicators associatedwith previous searches, matches, contacts, and the like, such as with anicon to indicate past communication, and the like. In embodiments, theuser may use a filter set to find a group the user wants tomulti-select, grab, and move into another list.

Another feature of the community facility may be an ‘activity index’, orsimilar measure, such as for judging how active a user is on the system.For instance, a user performing M&A activities on the system may providea qualified view indicating whether they are a current M&A buyer or not,such as showing how active they are. The system may also findinformation that indicates activity from other sources, and import thatinformation to the system, thus providing a fuller indication of theuser's activity level within the system, such as how many deals theymight be working on.

Another feature of the community facility may enable a user to enticeother users who are anonymous to be visible in order to initiate aninteraction with them. For instance, a user may contact an anonymoususer and add them to an exchange after the invitation to connect hasbeen accepted. The user may ‘click on’ an anonymous user and send aninvitation to them. In this instance, the sending user may become morevisible to the anonymous user who is being invited. A subject line and anote regarding why the user is interested in contact them may beprovided. An ‘invitations list’ may show what invitations have beensent, and the system may provide for a historical thread for the user'sactivity.

In embodiments, the system may keep a user's information anonymous untilthe user accepts an invitation from the inviting user, but where theanonymous user can still interact with the inviting user while stillstaying anonymous. The system may therefore provide a robust interactionfacility at the profile level (email, etc.) without requiring actualacceptance of the invitation, and enable a continued dialog withoutrevealing who they were (e.g., to get additional information,clarification, etc.). As the interaction goes back and forth, the goalmay be to wind up in an acceptance state, but the system may alsoprovide a means of blocking communications, such as after the user‘accepts’ or ‘declines’. The system may support an interaction until theuser provides an acceptance, at which time the user's contactinformation may become visible, be provided a download of profileinformation, include the user in a contacts list, be recommended to anexchange, and the like. Once the user accepts, both parties may becomevisible to one another, including providing a history of theinteraction.

The community facility may provide a user interface for user interactionwith the community facility, such as a with a profile tab for a user. Inembodiments, a new profile may be added through the user interface. Theuser interface may provide for identification of a sub-file, selectionof an industry, selection of a geography, setting profile details,setting visibility, adjusting a privacy policy, and the like. Inembodiments, a view for setting visibility may be provided, where theuser may specify visibility to community members, such as being visibleto community members, visible but anonymous to community members (e.g.contact information and attachment(s) are hidden), visible only theuser, and the like. For example, a profile for an M&A seller seekinginvestors, may include an industry focus (such as materials), deal sizes(such as <$25 Million), geography (such as Asia/Pacific), deal type(such as full entity sale/merger), visibility (such as anonymous), andthe like.

The community facility user interface may provide for a plurality oftabs, such as a hub, exchanges, tasks, documents, people, approvals,maintenance, forms, calendar, dashboards, fund data, collaboration, andthe like. There may be actions the user may take with regard to a searchresult, such as to make contact, open an invitation, view detail,download a vCard, request to add a user to an exchange, manage a userexchange access, and the like. When a user is anonymous, an indicationof such may be provided in place of their name, such as ‘User isAnonymous’, blanks in place of location, phone number, email contactinformation, company, and the like. An interface for composing aninvitation may be provided. For example, users that receive aninvitation may be asked to accept or decline the invitation, and thesending user may receive replies as email alerts (e.g., such asavailable under the community invitations section of the userinterface). The invitation may include a subject, note, number of usersthe invitation is being sent to, information about the sending user(e.g. name, email ID, phone number), a cc function, and the like. Aninvitation may be provide to a visible user, an anonymous user,logged-in users, logged-out users, and the like. Successfully sending aninvitation may result in an acknowledgement, such as an invitationalert, a text alert, and the like. An ‘alert sent’ indication may beprovided. For example, an indication of a successful alert sent may alsoinclude a dialog indication, a title of the invitation, the body of theinvitation, and the like. Users that receive a note may be able to replydirectly to the sending user's email address. In some cases, userinformation may be left blank when the user is an anonymous user, suchas email contact information, organization, position, industry,functional area, address information, phone number(s), fax number, andthe like. In some cases, at least a portion of the information may behidden, such as for example that the user is an M&A advisor/expert, areaof expertise is investment banking, industry focus areas (e.g.industrials, financials, utilities, telecommunication services, healthcare, information technology, energy, consumer discretionary, materials,consumer staples), deal sizes, geography, and the like. Invitationalerts may be provided to a user's inbox, and various options may beprovided to a user, such as to accept or decline the invitation, a‘decline invitation’ screen, and records kept for invitations sent,received, accepted, declined, and the like. A running communicationsthread between two users in association with an invitation may beprovided, wherein the accept-decline options may continue to bepresented to the recipient of the invitation until they accept ordecline the invitation. A feature for searching contacts may beprovided.

Features for contact flow between two users may be provided. For exampleuser 1 may set up a sub-profile that includes setting their visibilityto anonymous. User 2 may conduct a community search and find user 1,where user 2 opens a user details page(s). User 2 may then send aninquiry to the anonymous user 1, where user 1 receives the inquiry (suchas in their email inbox) and views the invitation in a community userinterface. User 1 then has the option to accept or decline theinvitation, where user 1 then closes the reply window. User 2 is able tosee the inquiry status, such as through searching, where user 2 sees theinquiry, sees the status of accept or decline. User 1 is able to viewthe thread of the accepted/declined notes.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, the method includingestablishing, by a secure exchange server controlled by an intermediatebusiness entity, a client login data authentication procedure thatallows at least one client computing device of a plurality of clientcomputing devices operated by users of a plurality of business entitiesto access the secure exchange server, wherein communications between thesecure exchange server and the plurality of client computing devices isthrough a communications network; storing, by the secure exchangeserver, at least one client login authentication data for each of theplurality of client computing devices; receiving content from a first ofthe plurality of client computing devices; by the secure exchangeserver, permitting access to the content for a subset of the pluralityof computing devices through an exchange content access facility,wherein the exchange content access facility is managed by at least onebusiness entity of the plurality of business entities; granting, by theexchange server, access to the content to a second of the plurality ofclient computing devices when the secure exchange server receives fromthe second of the plurality of client computing devices its client loginauthentication data provided that the second of the plurality of clientcomputing devices is one of the subset of the plurality of computingdevices; and providing an exchange community facility where the users ofthe plurality of client computing devices establish an informationalprofile that is made accessible to other users of the plurality ofclient computers and are enabled to interact with one another based onthe content of the informational profile.

In embodiments, access to the exchange server by client processors maybe through a host server controlled by the business entity that controlsthe client processor. The client computing devices may be at least oneof owned and managed by at least one of the plurality of businessentities. The client computing devices may be owned by individual users.The secure exchange server may be at least one of a plurality ofexchange servers. The content may be at least one of a document, aspreadsheet, a message, data, an image, audio content, video content,multimedia content, and the like. The content may be transferred to thesecure exchange server via encrypted data transmission.

In embodiments, the content of the informational profile may includecontact information, business association, and the like. The exchangecommunity facility may provide users with facilities for sending aninvitation to another user for communication. After the invitation issent the exchange community facility may provide a status of theinvitation related to the invitation being at least one of being sent,received, and read. The informational profile for the sending user maybe restricted as anonymous until the receiving user accepts theinvitation for communication. The exchange community facility mayprovide for informational profile viewing control, where the viewingcontrol allows the informational profile to be viewed by other users, bya selected group of users, and the like. The exchange community facilitymay provide a graphical user interface through which a user managestheir informational profile and interactions with other users, where thegraphical user interface includes a search engine interface, provides anactivity index measure of how active a user is on the exchange communityfacility, and the like. An informational profile may be categorized byprofessional activity, such as including a buyer, seller, investor,expert, and the like. The informational profile may include credentialsfor an individual, an indication of an area of interest (e.g. a type ofproject in which an individual is interested in participating), and thelike.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing an exchange community facility wherethe users of the plurality of client computing devices establish aninformational profile that is made accessible to other users of theplurality of client computers and are enabled to interact with oneanother based on the content of the informational profile, wherein theinteraction is executed as an anonymous interaction, where the anonymousinteraction provides a subset of content from the informational profile.

Amendment Voting

Referring to FIG. 4, the amendment voting facility 204 may provide formanaging, integrating, and facilitating a process where agency clientsexecuting a transaction (e.g. a syndicated loan) may vote onmodifications or amendments to a transaction or transaction content,including an auditable process 402, aggregated vote metrics 404,centralized vote processing 408, and the like. The auditing process 402may utilize vote documentation, consent forms, signature page tracking,digital distribution, vote collection, and signature page submission,and the like, where the these documents may be fully traceable. Thedistribution, vote collection and signature page submission may alloccur online, speeding the process and better ensuring transparency.Aggregating vote metrics 404 may utilize weighted voting calculationsfor consent percentage, visualization of responses (e.g. which lendershave done what), and the like, where vote calculations may be weightedby commitment percentage, and where a visual display of user responsesmay make it easy to see which users have taken action, and what thoseactions are. Centralized vote processing 408 may include sendingreminder alerts, completion of approval tasks, completion of a vote, andthe like. Features of the amendment voting facility 404 may includeamendment templates for quick configuration and launch, lender votingthat includes signature pate collection (e.g. with electronic submissionof signature pages), task lists for consent, an amendment voting userinterface 410 to track progress and statistics (e.g. group tracking,simplified reminders, export for vote tally and reporting), amendmentswithin existing exchanges, and the like.

An embodiment flow process diagram for the amendment voting facility mayinclude an initial step where an agency team initiates a vote responseinquiry, such as including documents, amendments, signature pages, duedates, automatic alerts, and the like. Lenders may then receive analert, including task assignments, such as for external counsel, theagency team, participants (e.g. lenders), and the like. Documents (e.g.,memos, signature pages) may be downloaded and tracked at a next step.Then, signature pages, such as a memo with a signature page, may besigned and submitted as a response. Participants (e.g., administratoragency, external counsel) may receive the vote response. In an externalprocess, votes may be weighted, such as based on committed dollaramounts on an agent's records. The process may be finalized, such aswith posting totals (e.g., for an agent back team), where members of theprocess (e.g. lenders and borrowers in a loan process) are notified. Inembodiments, the amendment voting facility may reduce or eliminate themanual process surrounding a vote collection and consent process, suchas associated with a loan process, and helps the user efficientlyprioritize a vote collection strategy.

In an example, on a syndicated loan, one agency bank may be in chargeand have a number of lenders supporting that loan, often hundreds oreven in excess of a thousand such lenders. As proposed modifications oramendments are made, each may need to be disseminated, have users reactto it (such as providing information, making selections, and the like),be returned with appropriate documentation to the agency bank, and thelike. A typical process is conventionally performed offline, where banksare required to have signing authorities pen-ink sign and re-submit tothe agency bank. Further to the example, when a new amendment comes up,the agency bank may create a new transaction exchange environment forthe amendment process. Through a data link the lender groups of membersof those groups may be pushed into the new exchange environment, suchthat each of them appears as a participant in the exchange. Datarelating to all current positions of the lenders (the amounts of theirfinancial positions with respect to the particular loan or loans) mayalso be pushed into the exchange, so that it is available for furtherprocessing. In embodiments, the current position of a user with respectto the transaction structure may have a bearing on the voting, such asthe weight given to a user's vote, minimum amounts related to theamendment, and the like. Such amounts may be stored and retrieved forprocessing by the exchange. For instance, an agency bank may ask lendersto confirm their understanding of their positions in the process, someor all of the data with respect to positions may be pre-populated intothe system and carried through into the transaction, and the like.

In embodiments, the amendment voting facility may allow for the namingof an amendment vote, a date for the vote, a vote distribution,inclusion of associated documents, facility for signature providing pagesubmissions, inclusion of instructions to voters, a process of approval,a step for outside counsel to review, and the like. Once theannouncement for the vote is sent out, an administrator agent may beable to view the tasks that have gone out, to what individuals andgroups, and the status of the voting. Features of the amendment votingfacility may include import and export of commitment data, support ofamendment vote collection workflow, creation of vote templateconfigurations, configuration of election forms, display of an amendmentvoting graphical user interface dashboard, configuration of signaturepages, access for an administrator to complete tasks, facility forclient-specific amendment vote definition, and the like. Import andexport may include users ability to populate a deal structureautomatically (e.g., from a source file), create a list of lendersgroups and tranches commitment information on a new deal exchange,reconcile an existing deal structure, generate reports (e.g. listingcommitment amounts for each participant, updating commitments, and thelike. Support of amendment vote collection workflow may include supportof a plurality of different amendment types and allow users to createprocess definitions available for run-time execution, and the like,where the different amendment types may include a simple yes-no, ayes-no with signature, consent-no consent, amend and extend, and thelike. Amendment vote collection workflow may include specification ofdue dates and time, collection of election options, distribution ofdocumentation, the ability to edit voting parameters, and the like.Creation of vote template configurations may include support of votetemplate configuration creation, such as to encapsulate the amendmentvote process for document control management, including users setting upowners, monitors, and vote elements once, and reusing for subsequentvotes; providing consistent language and instructions and documentationacross transactions and votes; setting up vote types that may beadjusted as-needed, and the like. The election form may be configured toallow users to dynamically generate election forms based on groupparticipant relationships (e.g. lenders only having visibility to casesthey have access to). Display of an amendment voting dashboard mayinclude view of a list of multiple amendments initiated for a particulartransaction, view of details of the process (e.g., list of lenders andtheir related status such s progress against a task), view ofparticipant contact and additional information, and the like.Configuration of the signature page may include custom text, a logo, andthe like, where users may update and maintain their own custom signaturepages, such as for all transactions, per transaction, per vote, and thelike.

Continuing with the syndicated loan example, a lender may receive anemail alert that they are invited into a new amendment task process.They may then be asked to login, where they are brought into the taskflow that came from the alert. Tasks may include instructions, documentreview, election options, and the like. Pre-populated information mayalso be provided in association with the task. The user may record theirvote and save any amendments associated with their elections. Theirelection and amendments may be printable, where the user may then takethat document to the signatory to have it signed. In this instance, allof the information, including instructions may be included in the hardcopy for the lender, and where the signing indicates legal consent. Inthis way, there may be one single entry point of information, where thelender receives the document to be signed, has it signed, and isprovided a facility for loading the document back into the system. Inembodiments, an e-signature and described herein may also be utilizedfor signing the document and entry into the system.

In embodiments, a user may be provided the user interface 410 to viewthe exchanges that are running amendments, to see tasks generated andwhat state they are in, to view individual tasks for a particularlender, to view signature pages (e.g., where all of the election optioninformation is carried), and the like. Custom fields may also beprovided, such as to allow users to change commitments. In embodiments,users may see information as the data is populated, even beforesignatures are applied. A user may need to perform a calculation, suchas to weight each vote to see how close they are to carrying theamendment. The system may enable the user to export data to a document(e.g., a spreadsheet) for performing the calculation separate from thesystem, and to monitor the amendment process and changes thereto. Forinstance, and continuing with the loan syndication example, anadministrator agent may be most interested in monitoring response levelsand challenges to the current commitment levels. For instance, if onlythree users are seen to have any challenge on their commitment amounts,then the administrator may need to handle those first, which may be apriority if there is a discrepancy. The user may also be interested inthose who are planning to take action (e.g., increase their commitment,reduce their commitment, by how much their commitment may change, andthe like). Ultimately, the agency bank may have the final say, and sothe system may provide them with priority, and so enable them to decideon whether to allow the changes or not.

An exemplary amendment voting facility user interface may includevarious features, such as an dashboard listing and graphic showing thestatus of a user's amendment voting, where the graphic shown displays,for example, a pie graph of ‘no consent’, ‘consent’, and ‘no response’,as well as a listing of specific amendment voting statuses. A userinterface may show a user notification of being assigned an amendmentvote task, a user interface may show distribution of an amendment vote,and options available to the user for making the amendment vote,including to ‘agree’ or to ‘disagree’ with for example, a specifieddollar amount commitment. A listing of an amendment voting task statusfor a user may be displayed, as well as a signature page being submittedby a user, which may include for example a note stating, “Please find mysignature page attached, for review”. The user interface may provideupdated listing and status for the user's amendment voting tasks.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment, the method including establishing,by a secure exchange server controlled by an intermediate businessentity, a client login data authentication procedure that allows atleast one client computing device of a plurality of client computingdevices operated by users of a plurality of business entities to accessthe secure exchange server, wherein communications between the secureexchange server and the plurality of client computing devices is througha communications network; storing, by the secure exchange server, atleast one client login authentication data for each of the plurality ofclient computing devices; receiving content from a first of theplurality of client computing devices; by the secure exchange server,permitting access to the content for a subset of the plurality ofcomputing devices through an exchange content access facility, whereinthe exchange content access facility is managed by at least one businessentity of the plurality of business entities; granting, by the exchangeserver, access to the content to a second of the plurality of clientcomputing devices when the secure exchange server receives from thesecond of the plurality of client computing devices its client loginauthentication data provided that the second of the plurality of clientcomputing devices is one of the subset of the plurality of computingdevices; and providing an amendment voting facility for conducting aprocess of voting when the content relates to a proposed amendment to anagreement wherein the amendment voting facility enables users of thesubset of the plurality of computing devices to vote on the proposedamendment.

In embodiments, access to the exchange server by client processors maybe through a host server controlled by the business entity that controlsthe client processor. The client computing devices may be at least oneof owned and managed by at least one of the plurality of businessentities. The client computing devices may be owned by individual users.The secure exchange server may be at least one of a plurality ofexchange servers. The content may be at least one of a document, aspreadsheet, a message, data, an image, audio content, video content,multimedia content, and the like. The content may be transferred to thesecure exchange server via encrypted data transmission.

In embodiments, the process of voting on the proposed amendment may betraceable, such as traceability including tracing vote documentation,consent forms, signature pages, digital distribution, vote collection,signature page submission, and the like. The amendment voting facilitymay provide for the aggregating of vote metrics for tracking the processof voting amongst the users of the subset of the plurality of computingdevices, such as aggregating vote metrics utilizing weighted votingcalculations for consent percentage and visualization of responses. Theamendment voting facility may provide for a vote graphical userinterface dashboard to track progress and statistics, such as where thetracking of progress and statistics includes group tracking, reminders,export for vote tally and reporting, and the like. The amendment votingfacility may provide for relative weighting of votes amongst the votingusers. The amendment voting facility may provide for management of thevoting process including a date for the vote, a vote distribution list,inclusion of associated documents, facility for signature-providing pagesubmissions, inclusion of instructions to voters, a process of approval,a step for outside counsel to review, and the like. A vote may be castas a yes-no vote, a yes-no vote with signature, a consent, and the like.A voting form may be provided, where the voting form is configured toallow users to dynamically generate voting forms, such as where thedynamically generated voting forms are based on user participantrelationships. The voting form may include a user customizable text orlogo.

Electronic Signature Facility

Referring to FIG. 5, the secure electronic signature facility 208 (alsoreferred to herein as ‘e-signature facility’ or ‘e-signing’ herein) maysupport the process of providing documents for signature and for a usere-signing and sending the e-signed documents back to the sender. Inembodiments, the electronic signature facility 208 may provide forsecure viewing of the document signing, such as through face recognition504 to determine the number of people viewing the monitor on which thesigning is being executed and/or utilizing a digital photo of a user toverify the user is who they say they are, utilizing biometricauthentication 508, utilizing screen obfuscation 510 to ensure onlyauthorized users are viewing the document for signing, and the like. Forinstance, a computing device being used for e-signature may have acamera that views and detects the surrounding environment to determinehow many people are currently viewing the screen, and if a conditionexists where there is not only one person viewing the screen, the screenmay obfuscate the document being e-signed, such as blurring, blanking,screening, and the like. For example, if the computer device detectsthat no one is viewing or multiple people are viewing the screen, thescreen may blank out the document. In another instance, the computingdevice may utilize a camera to match the face of the person viewing thescreen with a stored image of the person that is authorized to e-sign,and if the match is made, permitting the process of e-signing toproceed. In another instance, a biometric match may be required topermit the process of e-signing to proceed, such as through the use of amatch to an iris as viewed through a camera, an e-fingerprint through afingerprint pad for input to the computing device, or any otherbiometric verification method known to the art. In embodiments,conditions for enabling an e-signature process to proceed may be storedin a user profile 512, where if the conditions (e.g. number of peopleviewing, authorization matching though images and/or biometrics) are notmet, the document may be obfuscated.

A user interface for turning on an e-signature process for an exchangemay include various features. Note that in embodiments a user may onlybe able to view the document, or portion of the document, for which thee-signature applies. For instance, through the viewer facility,non-applicable portions of the document may be blocked out in some wayas described herein. The user interface may include a toolbar fore-signature, where the user may click on an e-signature icon to initiate(or terminate) an e-signature process. Further the user interface mayallow a user to move around an e-signature by dragging the e-signaturewith the mouse. The user may be able to perform a number of documentfunctions, such as find, zoom, rotate, page up-down, and the like. Inembodiments, if any portion of the e-signature is moved by the user to aposition that places it off the page, the signature function may bedisabled (e.g. e-signature disappears) to avoid placement of thee-signature in a position that won't show the entire e-signature on thedocument once the process is complete. Once the user has placed thee-signature, they may apply the signature and complete the process. Aconfirmation dialog box for completion of the e-signature process may beprovided, including a confirmation note to the user about the finalplacement of the e-signature, where the user may be allowed to return toplacement of the e-signature if they are not satisfied. The user, oncesatisfied, may save the e-signature application and placement. If thereare unsaved changes at a time when the user attempt to close theapplication a prompt may appear notifying the user that there areunsaved changes and asking them if they want to save or close withoutsaving. A dialog box may be provided for cancelling an e-signature, withfor example control buttons for confirming whether to cancel or tocontinue.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, the method includingestablishing, by a secure exchange server controlled by an intermediatebusiness entity, a client login data authentication procedure thatallows at least one client computing device of a plurality of clientcomputing devices operated by users of a plurality of business entitiesto access the secure exchange server, wherein communications between thesecure exchange server and the plurality of client computing devices isthrough a communications network; storing, by the secure exchangeserver, at least one client login authentication data for each of theplurality of client computing devices; receiving content from a first ofthe plurality of client computing devices; by the secure exchangeserver, permitting access to the content for a subset of the pluralityof computing devices through an exchange content access facility,wherein the exchange content access facility is managed by at least onebusiness entity of the plurality of business entities; granting, by theexchange server, access to the content to a second of the plurality ofclient computing devices when the secure exchange server receives fromthe second of the plurality of client computing devices its client loginauthentication data provided that the second of the plurality of clientcomputing devices is one of the subset of the plurality of computingdevices; and providing an electronic signature facility for managing aprocess of signing the received content by at least one of the subset ofthe plurality of computing devices, wherein the electronic signaturefacility includes a signature viewer interface that restricts viewing ofthe content for signing.

In embodiments, access to the exchange server by client processors maybe through a host server controlled by the business entity that controlsthe client processor. The client computing devices may be at least oneof owned and managed by at least one of the plurality of businessentities. The client computing devices may be owned by individual users.The secure exchange server may be at least one of a plurality ofexchange servers. The content may be at least one of a document, aspreadsheet, a message, data, an image, audio content, video content,multimedia content, and the like. The content may be transferred to thesecure exchange server via encrypted data transmission.

In embodiments, the electronic signature facility may include anelectronic signature graphical user interface for presenting the contentfor signing. The restricted viewing may be a signing user beingrestricted to only those portions of the content that the signing useris authorized to view. The restricted viewing may be a signing userbeing restricted to only those portions of the content for which thesigning applies.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing an electronic signature facility formanaging a process of signing the received content by at least one ofthe subset of the plurality of computing devices, wherein the electronicsignature facility verifies the identity of the signing user throughbiometric profiling utilizing previously stored biometric data from thesigning user.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing an electronic signature facility formanaging a process of signing the received content by at least one ofthe subset of the plurality of computing devices, the electronicsignature facility assembling an electronically signed documentincluding signatures from a plurality of users, each of which has hadaccess to only a subset of the content for which they were thesignatory.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing an electronic signature facility formanaging a process of signing the received content by at least one ofthe subset of the plurality of computing devices, wherein the electronicsignature facility provides for secure viewing of the content aspresented to a signing user through a computer display of the signinguser's client computing device, wherein the user's client computingdevice includes an integrated camera for viewing the environment aroundthe signing user and a face detection facility for recognizing thesigning user, detecting if the signing user is the only individualpresent in the viewed environment, and if not, obfuscates the viewing ofthe content. The obfuscation may be blanking the screen, distorting theviewing of the content, and the like. The detection of the signing userby the face detection facility may be accomplished by comparing an imageof a previously stored facial image of the signing user to the facedetected in the viewed environment.

In embodiments, the electronic signature facility 208 may provide aunique signature code ID for a signature page, such that the signaturecode ID is unique in the system, thus providing a unique identifier forthe signature page. Thus, the methods and systems disclosed hereininclude methods and systems for creating a repository of signature pagesfor an enterprise, with related indexing of the locations of, as well aspreservation of, the content to which the signature pages relate. Withthis feature, a user may print out a signature page that has thesignature code ID, and be able to subsequently pull the printedsignature page out of a content store, and search the electronic storagesystem of an enterprise (e.g., a cloud, data center, file system, or thelike) for the document associated with the signature code ID to confirmwhat document was signed. This allows a user to maintain a paper-basedrecord in their records/files, but retain the ability to search for thee-document to which the signature page corresponds. The signature codeID may not only be unique to the signature page and associated document,but also to the version of the document, where the signature code ID maybe wiped-out if that document is revised or changed. In this way, thesystem may create a parallel structure between a paper-based system andthe electronic system, including revisions. The signature code ID may bestamped on one or more pages of the document. For instance, the documentmay be a PDF formatted document, and the stamp may be placed on all thePDF pages. This is only one simple example, but the signature code IDmay be used on any kind of digital content that needs to be signed orinitialed in any way. For example, sections of a document, such asclauses in a contract requiring separate approval (e.g., in real estateloan documents, rental car agreements, and the like) may be linked todistinct signature IDs, so that the approved clauses are separatelysearchable and verifiable electronically based on the signature IDs, andso that the system can identify any changes that may have been made tothe content that is associated with the signature. In embodiments, thesignature code ID may be stored as metadata with the digital content.The signature ID may be enabled with any conventional technique forproviding a unique ID, such as an encryption key, or the like. Inembodiments the key may be based on or include a hash of the contentwith respect to which the signature is associated, to assist inconforming that the signed content has not been changed when it isretrieved at a later time. Search for content may be enabled usinglocation indices, by storing IDs in content metadata, by searches onlinked lists or similar structures, by full text searches, or by othersearch and retrieval techniques known by those of ordinary skill in theart.

Dashboard Facility

Referring to FIG. 6, the dashboard facility 210 may provide organizedfacilities for managing exchanges amongst the plurality of exchangeservice users 110, disseminate to users of multiple groups of users,separating exchange environments, and the like. For example, for acorporate M&A or private equity group, the dashboard may provide userswith the ability to take their information, and create a profile andexpose the information to other parties (e.g., to private equityinvestors showing performance of their individual funds). The dashboardmay present information in an organized manner, allow for loading ofinformation through an information importer 602, provide permissions 604to view information, allow for the exporting of information through aninformation exporter 608, and the like. The dashboard may provide for atimeline view of activity in an exchange, work steam, project and thelike, thus providing a graphical view of activity over time. Thedashboard facility may provide for user access and display of bothstructured and unstructured data, access to views that provide a customformat or familiar terms to a particular category of transaction client(e.g., fund, investment documents, capital account statement, investmentteam), and the like, which also may restrict a user's view to contentapplicable to them or to the targeted category of transaction. In aprivate equity example, the user may configure the dashboard to theirspecific needs, such as including useful widgets 610 to display,information relating to the market (e.g. available funds). A fundswidget may provide for selection of a fund, providing overview andperformance information, and the like. There may also be sub-widgetsthat provide further functionality to a widget. The user may also havemultiple dashboards, such as for different exchanges, different markets,different deals, and the like. One dashboard may handle information thatis available to other users, and another dashboard may handle allpersonal files that are both available and unavailable to other users.The dashboard facility may also provide a compliance feature, such as totrack changes made in each dashboard. In embodiments, the dashboardfacility may present a view of exchanges in a list form, a visualfolders form, a tile display, a card view (e.g., a card view that flipsamongst exchanges or lower level organizations), and the like.Exchanges, work-streams, documents, and the like may be created, calledup, closed, and the like, by voice command, through gesture detection,and the like.

In an example of setting up a file exchange, an administrator 612 usermay place files within an input file directory, where the files may havea nomenclature that tells what widget they will populate. The system maycreate a configuration, run a process to populate it, ensure it iscorrect before allowing access, and the like. In this way, data may beconsidered ‘stage data’ prior to allowing access, and ‘production data’once approved. Once the user is comfortable with a view, they canproceed and publish the staged data into ‘production’. The system may beable to upload data as CSV file, create permissions files, and the like.In embodiments, a specific user might be provided a view within adashboard but be given only access to one or more records within thedashboard. For example, the user might only see a particular fund,rather than all funds. If they select that fund, they may be able to seechild data associated with that fund. But without permission, the otherfunds (or child data) would not be displayed. A permissions model maygive users access to specific records within the dashboard. In an M&Aexample, a user may be able to see all the live deals an organization ismanaging, a certain human resources team might be allowed to see thedashboard, and the like, where specific entities are providedpermissions.

The dashboard may have both optional and standard functionality, such asstandard filtering options, converting documents to a PDF format, andthe like. There may be a widget catalog provided, such as for textualdisplays, graphs and charts, document tracking, and the like.

The dashboard may enable management of files at a document level, at arecord level, and the like, such as to allow a user to add records andmanage information. A user may be able to add new content, put in therequired information, refresh the screen (e.g., on a per-deal basis),and the like. The user may be able to edit and delete existing records,show a parent-child relationship, and the like. The user might want tochoose the parent and find the document within the exchange and link itup to the parent document. The system may have the ability to manageindividual records, such as for dashboard data, but also to permissions.The user may be able to take a parent record and provide permission toone of the many users to enable access to those parents. In embodiments,the system may provide for an auditing facility, such as for trackingwho is adding records and permissions.

In embodiments, dashboard permissions may be automatically matched,provided, and the like, based on exchange permissions. For instance,dashboard permissions may be driven directly from the exchangepermissions associated with a particular exchange. In this instance,people may be part of an exchange with various permissions, and thelike, where they would send configuration files (e.g., CSV files) topermission through the dashboard, while they would manage groups andpermissions separately in the exchange. With permissions automaticallymatched, permissions would be provided in multiple places, such asthrough the configuration files as well as in the exchange. In suchembodiments, users may not have to use separate permission files,because the dashboard permissions may be able to follow from thepermissions of the exchange. In embodiments, the system may use amatching algorithm between the exchange and the dashboard, such as basedon fund information, and the like.

In embodiments, a permissions ‘view-as’ facility may be provided duringstaging of permissions for an exchange. For example, as a user isestablishing permissions for an exchange, a project, a work stream, orthe like, a user may initiate the “view-as” permissioning feature, suchas by drop down menu selection, clicking on an icon, or the like, whichmay include a menu or data entry capability (e.g., a text field, box orthe like) for selecting another user or category of user for which thepermissioning user wishes to simulate viewing. Upon initiation of the“view as” capability and selecting the user or category of user to besimulated by the permissioning user, the system may display an exchange,a work stream, a dashboard, a project, a store, or a particular contentitem to the permissioning user as if the permissioning user were theother user selected by the permissioning user or as if the permissioninguser is a member of the selected category of user. Thus, thepermissioning user may see documents as if they were another user, so asto confirm that they have established the desired permissioning beforegoing live with the exchange, project, work stream, or the like. Ineffect, in such embodiments the system combines the staging andverification of permissioning into two concepts, with simulated viewingproviding verification that is simultaneous with, or proximate in timewith, staging.

A user interface may be provided, which for example, provides a listingof available funds and fund information, providing a plurality ofcolumns for content. Editing tools for editing specific column contentmay be provided. Various tools may be provided for editing a fund, suchas editing specific column content. Alerts may be generated for acondition under which the user cannot save edits, such as because theuser no longer has the latest version of the data (e.g., new data wasuploaded or another user edited the content since the time the userinterface dashboard was opened). In this instance, a control button maybe provided to update the dashboard data. A dialog box for creating anew fund may also be provided, for attaching a documents, for providingpermissions in association with the example fund, including for exampleproviding an ID of the user wanting to change permissions, and the like.

Email-In Facility

Referring to FIG. 7, the Email-in facility 212 may provide for theability to add content to an exchange using regular email, such as sentto a designated email address. This facility may be especially importantwith respect to users that circulate critical information and documentsvia email, and where there is a tendency to lose track of it at somepoint. Users may use the system's email-in facility to store email in asecure repository 702, and to be able to tell people to send email tothis repository as part of a regular business process. The exchangemanager 712 may then review and process the information further. Thismay simplify the learning curve of using any web application. If themanager is very knowledgeable, he may not need all of thecounter-parties to spend time learning the application. They simply sendthe content into an exchange. Other features may include an emailaddress being associated with a folder in an exchange, a maximum numberof allowed emails in an exchange (e.g. a user may define a cap), anemail conversion facility 704, a white-list and black-list 708 of users,notifications 710 of success and/or error, and the like. In embodiments,email-in may be limited to authorized users only, such as already in theexchange, listed on a white list, and the like.

Use cases for email-in may include submission of analysis documents forreview, a method for having a third party review applications (e.g. inorder to create accounts while ensuring the third party does not gaincontrol over attachments that contain private information), and thelike. In addition, the system may provide for folder permissions in theemail folder that can be used to prevent misuse. For compliance, theuser may be able to store communications in an archive 714 and trackwhat was done in association with the communications.

In embodiments, any exchange may be set up with email-in as a feature.An administrator or client may go through the process, such as definingwhere the sender's email address is stored in the system, using customfields for the ‘from’ field, storing the message as an email, cap themaximum emails it can accept, choosing the folder it will be associatedwith, and the like. A folder location may thus be mapped to an emailaddress (e.g., with the domain pre-defined but the pre-fix available forend user definition). The user may select users to be included for thefeature, set alert settings and notification settings (e.g. problemalerts, that something was added), and the like. A white list may beincluded, such as for who should be able to send emails into theexchange (e.g. could be domains or even addresses). If a user is not onthe white list, they may not be able to send emails to the exchange. Ablack list may be included, where a user may choose users to refuseacceptance onto the exchange.

The email-in facility may create a folder structure within a pre-definedmapped folder, and create a sub-folder for each email that is sent intothe exchange, such as with the subject as the title of that folder.Contents of the folders may then include any attached documents. Theemail-in content may be organized like any exchange, where new emailsare added as they come in. The system may be configured to send to agroup, or to only one. For instance, a user may send the folder to oneperson to review but not give the recipient the right to do resend,print, or save the document. Permission may be applied to the documentslike any other document as described herein, such as who can review thecorrespondence, who can modify it, save it, print it, and the like. Inembodiments, an event trigger facility 718 may be provided wherereceived email may trigger an event, such as a task, a process, and thelike. For instance, if a contract comes in it may trigger a renewalprocess. In another instance, an amendment process may be triggered withthe reception of an email.

In embodiments, the email-in facility may include the collection ofemails from various parties into a structured database for latermanagement and processing by a critical information exchange manager,eliminate the learning curve of using a web application to uploaddocument to the cloud, allow specific internal-external parties to postdocuments into a web folder that may be shared with predefinedindividuals at various control levels, and the like. Components mayinclude an email address associated with a folder in an exchange, amaximum number of allowed emails in an exchange, a definition of emailconversion options, a white list, a black list, notifications on successand/or error, and the like. In an example, client or prospect requestsmay be processed, such as for an investment firm with a need to submitdocuments for analysis, a bank looking for a way to have a third partreview applications to create new accounts while ensuring that the thirdparty does not gain control over the attachments that contain privateinformation, a bank having compliance needs such as needing to archiveall communications they have (e.g. cc′ing and replying to the system onall correspondences), and the like. A user interface for email-in mayinclude an introduction to email-in to the user, and a control button tobegin the process. In embodiments, there may be a number ofsteps/options in the execution of email-in, such as choosing basicoptions, mapping folders, selecting alert recipients, creation of awhite list, creation of a black list, enabling-disabling of the system,and the like. A dialog box may be provided for selection of basicoptions, including a custom field selection for the ‘from’ of an email,how incoming email body content be stored, definitions for the maximumnumber of emails that should be accepted into the exchange, and thelike. Dialog boxes for selection of a folder in association with mappingfolders may be provided, with an alert being generated when a duplicateemail address is used, for example. Users and their alert settings maybe selected via a user interface, and warnings generated for a duplicatedomain or email address associated with the creation of a blacklist. Achecklist in association with the enabling of the system may beprovided, such as shown in the figure for selection of a custom field,mapping to two folders, folders for mapping email into, no maximumspecified for number of emails, two domains listed on a white list, andone domain listed on a black list. A user interface may be presented tothe user once email-in is enabled, showing tabs for listing options,mapped folders, alert recipients, white lists, black lists, and thelike, and showing specifically the email-in options.

In embodiments, intermediate fields/forms for mapping an email thread tothe right place on an exchange may be provided. For example, if a useremails content relevant to a transaction or other project that is beingexecuted on or with the help of an exchange (e.g., foreign exchangestatement, a request to do a transaction, a securities document, arequest for materials, a status update, or any of a wide range of othercommunications relevant to a project or an exchange) the system may mapfrom an email application or environment where an email or email threadresides, such as Outlook, Gmail, or the like to a location of anexchange. The system may, for example, identify to which customer,enterprise, project, or individual the email is related. For instance,by recognizing the domain or the identity of the sender, the domain oridentity of the recipient, the subject, an identifier related to theexchange (such as automatically embedded in content or communicationsrelating to the exchange), content in the email thread or the like. Oncerecognized, the system may map the email thread to the appropriateexchange, location, store, project, or the like, associated with theexchange. In embodiments, once a mapping is identified, or a possiblemapping is proposed, a form may be presented that, if used, willfacilitate effective association with the exchange. For example, a formmay have appropriate custom fields that map data of selected types toappropriate locations associated with the exchange, so that content ofparticular types is automatically and intelligently routed to the rightplaces on an exchange. In this way, for instance, the ‘To:’ field of anemail environment can be expanded in the form to present a set of fieldsor a mapping to a set of exchange locations, not just an email addressor list of addresses. The rules for presenting a form and managingmapping from email forms to exchanges may be built into the exchange,such as in a meta-data triggered or meta-data managed business process.In one example, a user may create a safety report for a drug, such aswhere there has already been a related death, using an exchange tomanage storage and distribution of the safety report to appropriaterecipients. In this case, external regulations may specify who needs tobe informed of what information in the safety report, and the exchangemay store such rules, embodying them in forms that are presented when anemail is identified as relating to that exchange or that safety report,so that distribution of the safety report to the right individuals (viathe correct locations on the exchange) is enabled directly from theemail environment in which the safety report is initially distributed.In another example, an email related to a merger transaction may have asubject line indicating that attachments to the email are responsive toa due diligence request on real estate matters of a target company. Uponrecognizing the subject, the exchange, based on its specified rules, maypresent a form in the email environment prompting the user to direct theemail to the section of the exchange that relates to “real estate duediligence,” thus assuring that the content thread is appropriatelymapped to, and stored with, the other content for that section of theexchange (and subsequently allowing the exchange to provide otherfeatures described herein and known to those of ordinary skill in theart, such as automatically notifying participants of updates to thecontent). Thus, exchange-specific rules (which may apply to exchanges,or to projects, work streams, or the like within an exchange) mayindicate what information is required, who should be informed, and thelike, and custom, or even pre-populated fields may conveniently bepresented in response to initiation of email interactions with anexchange, project, work stream, or the like. Thus, this may be aconvenient mechanism to trigger actions, and provide greater flexibilityto improve system capabilities.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, the method includingestablishing, by a secure exchange server controlled by an intermediatebusiness entity, a client login data authentication procedure thatallows at least one client computing device of a plurality of clientcomputing devices operated by users of a plurality of business entitiesto access the secure exchange server, wherein communications between thesecure exchange server and the plurality of client computing devices isthrough a communications network; storing, by the secure exchangeserver, at least one client login authentication data for each of theplurality of client computing devices; receiving content from a first ofthe plurality of client computing devices; by the secure exchangeserver, permitting access to the content for a subset of the pluralityof computing devices through an exchange content access facility,wherein the exchange content access facility is managed by at least onebusiness entity of the plurality of business entities; granting, by theexchange server, access to the content to a second of the plurality ofclient computing devices when the secure exchange server receives fromthe second of the plurality of client computing devices its client loginauthentication data provided that the second of the plurality of clientcomputing devices is one of the subset of the plurality of computingdevices; and providing a secure email input facility for acceptingnon-secure email from outside the exchange into the secure collaborativecomputer data exchange environment, wherein the non-secure email isreceived and stored as secure email in the secure exchange server.

In embodiments, access to the exchange server by client processors maybe through a host server controlled by the business entity that controlsthe client processor. The client computing devices may be at least oneof owned and managed by at least one of the plurality of businessentities. The client computing devices may be owned by individual users.The secure exchange server may be at least one of a plurality ofexchange servers. The content may be at least one of a document, aspreadsheet, a message, data, an image, audio content, video content,multimedia content, and the like. The content may be transferred to thesecure exchange server via encrypted data transmission.

In embodiments, the acceptance of the non-secure email may be dependentupon a controlled listing stored in the secure exchange server, wherethe listing is a white listing specifying emails that are allowed, ablack listing specifying email that are not allowed, and the like. Thereception of a non-secure email may trigger an event, where thetriggered event is the initiation of a content amendment process, theinitiation of a new exchange, the distribution of the email within theexchange, storage of the email in a secure archive facility, and thelike. The email may be automatically associated with an area of contenton the exchange based on the sender of the email, the subject line ofthe email, the destination address of the email within the exchange andthe content of the email, and the like.

Viewer Facility

Referring to FIG. 8, the viewer facility 214 may provide for a secureviewing 802 protection of documents from unauthorized viewing, printing,saving, and the like, such as without having to install custom clientsoftware (e.g. without installing anything beyond Adobe Flash).Documents in certain formats, such as Microsoft Office products, PDFdocuments, and the like, may be supported for protection. For example,for a PDF document a security warning may appear that a user is onlyallowed to view the document. However, if the user tries to print thescreen, the screen may distort, such as transitioning to a fuzzy state.In embodiments, the user may need to hold the enter key down to make thedocument viewable. The user may be able to page up and down, rotate,zoom, and the like. The system may provide for watermarking the documentso that if a user is permitted to print screen, the document will printwith the watermarking. The viewer facility may also include functionssuch as viewing annotations 804 in the viewer, connectivity with thee-signing facility 208 (e.g. with a ‘stamping’ tool), documentvisibility based on face detection, document protection fromeavesdroppers (e.g. automatic limitation of document viewing, alsoreferred herein as spotlighting, based on detection of a second face),granular/page level document access reports 808, document protection 810using facial recognition based encryption, text to voice feature 812(e.g. such as in Apple® Siri), hand gesture based controls 814 (e.g.scrolling control based on hand-fist movement), real-time white-boarding818, secure video chat 820 (e.g. one-on-one, group), and the like. Inembodiments, the viewer facility may include an audio comment component,such as to allow a user to input comments into the document throughaudio dictation, to have the viewer facility play back the comments inaudio, to provide audio output for various aspects of the document, andthe like.

In embodiments, the viewer may be able to detect faces and enhancesecurity based on face detection, such as through utilization of acamera connected to or integrated with the computing device being usedto view content. The viewer may also utilize a ‘secure view’, such aswhere only a portion of a document is made viewable by the personviewing the document. Secure view may implement security measures (e.g.blanking the screen, distorting the screen, putting up a screen) basedon eye motion, movement of the face, the presence of a second face, andthe like. Viewing time may be monitored and reported, audited, and thelike, based on how long the user's face has looked at the document,where the monitoring, reporting, auditing, and the like may be providedautomatically. Reports of viewing time may be developed as a result ofthe viewing monitoring, such as reporting of page-based timing duringthe viewing of a document. In this instance, every page may be tracked.But many more details from the monitoring may also be reported, such aswhether the person closed the browser; whether a person is looking atthe screen, looking away from the screen, or walking away from thecomputer; Internet connection status; and/or computer configurationstatus (e.g., computer going into sleep mode, initiation of a screensaver, folding up of the computer, presentation of other content onanother open window of the screen (e.g., entertainment content), playingof audio content via the audio system of a computer (e.g., if the useris listening to music), and the like. The system may take thisinformation and develop a mapping of or report on the person's viewingactions and behaviors with respect to pages of content.

Document encryption and decryption may be provided based on documentpermissions. For instance, if the document can only be opened by aspecific number of people, face detection may use the author, or anyother permissioned user's face to encrypt the document and require thesame face to be detected to allow ‘un-locking’ of the document.Encryption of the face may then be ‘recorded’ and used as an electronicsignature, thereby tying the face to the user's profile. Recording ofviewing time may be on a document level, on a per page basis, and thelike. For instance, a computing device being used for viewing a documentmay have a camera that views and detects the surrounding environment todetermine how many people are currently viewing the screen, and if acondition exists where there is not only one person viewing the screen,the screen may obfuscate the document being viewed, such as blurring,blanking, screening, and the like. For example, if the computer devicedetects that no one is viewing or multiple people are viewing thescreen, the screen may blank out the document. In another instance, thecomputing device may utilize a camera to match the face of the personviewing the screen with a stored image of the person that is authorizedto access and view, and if the match is made, permitting the process ofaccess and viewing to proceed. In another instance, a biometric matchmay be required to permit the process of viewing to proceed, such asthrough the use of a match to an iris as viewed through a camera, ane-fingerprint through a fingerprint pad for input to the computingdevice, or any other biometric verification method known to the art. Inembodiments, conditions for enabling an access and viewing process toproceed may be stored in a user profile, where if the conditions (e.g.number of people viewing, authorization matching though images and/orbiometrics) are not met, the document may be obfuscated, or accessdenied.

In embodiments, viewing statistics may be mined for businessintelligence by sellers in a strategic transaction, such as through aCIO with an enterprise, a marketing analyst, or any such user who maybenefit from knowing with content is being read and what content is notbeing read.

In embodiments, the viewer may provide a search facility to searchwithin a document. The system may allow for highlighting a searchresult, highlighting a selected portion of the document, and the like.The system may provide facilities for annotating, marking, commenting,and the like, to a document, such as a private annotation for the user,a shared annotation for other users, and the like. The system mayprovide for a secure document view, where only some portions of thedocument are viewable. For instance, a user may only want to showanother user a selected portion of a document. The secure document viewmay also allow a user to increase the size of the document view window,which may better ensure that people proximate to you only see therelevant portions of the document. Another feature of the securedocument view may include distorting those portions of the document thatare not selected for viewing, such as making those sections fuzzy. Thesecure document view may react to the eye movement of the user, such asscrolling the document as the user's eye gaze direction shifts,distorting or blocking the document from view if the user looks awayfrom the viewer, and the like.

The viewing facility may have capabilities for dealing with certaindocument formats in a standard way. For instance, the system mayautomatically convert Microsoft Word and PowerPoint documents to a PDFformat, open spreadsheets (e.g. Microsoft Excel) in a spreadsheetviewer, and the like. For instance, when an Excel document is opened, itmay be rendered on the fly, decrypted on the fly as a user scrolls down,retrieved from the server and encrypted on the fly, and the like.

A viewing facility may be provided, such as for use in a spreadsheet,word processor, and the like. As applied to a spreadsheet document, theviewing facility may provide features and tools such as a toolbar, apage/sheet count, a document search box, a spotlight interface, and ascrollbar. The viewing facility may also provide a search function andsample results and include a search window, a search results window,various ways that the results may be grouped by page/worksheet name, asearch term highlighted, and a displayed message, such as if some searchresults are displayed before the entire document search is complete. Aspotlight function may be provided, where only a portion of the documentis viewable. A dialog box may be provided to be responsive to a userclicking on the print icon. Note that printing may be restricted asdescribed herein, where the dialog box may send an alert to the useridentifying the restrictions. Various other features of the viewingfacility can be provided with respect to a sample word processingdocument, such as a toolbar, a page/sheet count, a document search box,a spotlight interface, and a scrollbar. Various features of the viewerfacility functions related to a print command may also be provided,including a print icon, a document window grayed out, a print window,printer options, range of pages for print, a cancel control button whereif the user cancels the print, the gray-out function may be turned offand again reveal the document, and a ‘next’ control button to close thepre-print window and open an operating system print dialog.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, the method includingestablishing, by a secure exchange server controlled by an intermediatebusiness entity, a client login data authentication procedure thatallows at least one client computing device of a plurality of clientcomputing devices operated by users of a plurality of business entitiesto access the secure exchange server, wherein communications between thesecure exchange server and the plurality of client computing devices isthrough a communications network; storing, by the secure exchangeserver, at least one client login authentication data for each of theplurality of client computing devices; receiving content from a first ofthe plurality of client computing devices; by the secure exchangeserver, permitting access to the content for a subset of the pluralityof computing devices through an exchange content access facility,wherein the exchange content access facility is managed by at least onebusiness entity of the plurality of business entities; granting, by theexchange server, access to the content to a second of the plurality ofclient computing devices when the secure exchange server receives fromthe second of the plurality of client computing devices its client loginauthentication data provided that the second of the plurality of clientcomputing devices is one of the subset of the plurality of computingdevices; and providing a secure content viewer facility for the user tosecurely view the content on the user's client computing device, whereinthe secure view is provided through a viewing restriction based on auser action.

In embodiments, access to the exchange server by client processors maybe through a host server controlled by the business entity that controlsthe client processor. The client computing devices may be at least oneof owned and managed by at least one of the plurality of businessentities. The client computing devices may be owned by individual users.The secure exchange server may be at least one of a plurality ofexchange servers. The content may be at least one of a document, aspreadsheet, a message, data, an image, audio content, video content,multimedia content, and the like. The content may be transferred to thesecure exchange server via encrypted data transmission.

In embodiments, the viewing restriction may be obfuscating the contentview when the user action is an attempt to print screen, a securitywarning when the user action is an attempt to view the document, a watermark being inserted on the content when the action is a user printingthe content, and the like. The client computing device may be a mobileclient computing device, such as personally owned by the user, andconfigured for secure content viewing through the business entity.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing a secure content viewer facility forthe user to securely view the content on the user's client computingdevice, wherein a secure view is provided through a viewing restrictionbased on a user action, the user action detected through an integratedcamera operating in conjunction with face recognition facility on theclient computing device and the viewing restriction being an obfuscationof the content view when the user is observed such that viewing of thecontent by others is at risk. The user may be observed with other peoplein view of the camera, with an eye-gaze that is away from the clientcomputing device, and the like.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing a content viewer monitoring facilityfor monitoring the user viewing the content on their client computingdevice, wherein the monitoring is provided through an integrated cameraoperating in conjunction with a face recognition facility on the clientcomputing device.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing a content viewer monitoring facilityfor monitoring the user viewing the content on their client computingdevice, wherein a content viewing access report is generated thatprovides statistics related to the time the user spends viewing portionsof the content. The portion of the content may be at a granular level ofa page of the content, at a granular level of the entire document, andthe like. The content viewing access report may provide for tracking andaudit reporting for the user viewing the content. The statistics may beused to develop business intelligence.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided, establishing, by asecure exchange server controlled by an intermediate business entity, anauthentication procedure for a client login authentication data thatallows at least one of a plurality of user client computing devicesoperated by users of at least two business entities to access the atleast one secure exchange server, wherein communications between thesecure exchange server and the plurality of user client computingdevices is through a communications network; storing, by the secureexchange server, the at least one client login authentication data foreach of the plurality of client computing devices; receiving, from afirst of the plurality of user client computing devices, content;associating access, by the secure exchange server, to the content to asubset of the plurality of user computing devices through an exchangecontent access facility, the exchange content access facility managed byat least one of the plurality of business entities; granting, by theexchange server, access to the content of the secure exchange server toa second of the plurality of user client computing devices when thesecure exchange server receives a client login authentication data fromthe second of the plurality of user client computing devices anddependent upon the second of the plurality of user client computingdevices being one of the subset of the plurality of user clientcomputing devices; and providing a content viewer control facility foruser-controlled viewing of the content on their client computing device,wherein the control is at least in part enabled through an integratedcamera operating in conjunction with a motion recognition facility onthe client computing device. The control may be actualized throughmonitoring user hand gestures, monitoring user eye movements, throughmonitoring user head movements, and the like. The control may beenabling the viewing of the content, tuning a page in viewing thecontent, inserting a signature into the content, closing a viewingsession for the content, and the like.

Playback of Interactions

In embodiments, viewer-based time reporting and viewer-based trackingmay be provided in an interactions playback facility 213 to allow a userof the system to replay the interactions of other users with particularcontent associated with an exchange. In embodiments, playback may beused to assist in review of user interactions in a transaction diligenceprocess. In such an example, a user's interaction with a viewed contentmay be played back to make it available in the context of a diligenceprocess that involves review of content on an exchange. For instance, ifa user reads a contract, the system may be able to replay the readingexperience to show what the user did when the viewer was looking at thedocument. The replay may include a summary or report of statisticsassociated with viewing, such as time spent on a page, engagement inother activities during the review, copying of material, focusing onparticular sub-parts of content, note taking related the content,annotation of the content, or the like. In embodiments, rules of anexchange may be specified for particular content to require a user toenable content interactions playback. For example, a user may berequired to turn on the user's device camera, so that the user can beviewed during the time in which the user engages with the content.Similarly, a user may be required to allow the exchange to capture anytext entered into the user's machine during the review of the content.Content playback may provide some insight and intelligence associatedwith the original interaction of a user with the document. For example,if a user spent considerable time on a page of a contract, this mayprovide an indication of concern with that page, such as difficultyunderstanding the content, or with a high degree of interest in thecontent. As another example, if a user spent considerable time on adocument containing a trade secret, that may indicate a high likelihoodthat the user learned the trade secret in the course of the review.

Buyer Interest Index

In embodiments, viewer time tracking information may be used to enablevarious analytic processes. For example, tracking information may help aseller determine the interest level of a potential buyer, such as in thedevelopment of a ‘buyer interest index’ to aid sellers in dealevaluation. Based on viewing patterns a user may be able to utilize sucha report or other analytic result to determine which buyer is mostlikely to buy, such as in projecting a winner in a bidding process,where the projection is based on a particular buyer's viewing historywith respect to documents associated with the deal or other actionstaken by a buyer with respect to an exchange (e.g., the extent to whichvarious individuals associated with a buyer engage with an exchange, orsections of an exchange, or a particular file). For example, a userspending a great deal of time looking at a financial document might bean indication that the potential buyer is skeptical, and not favoring aninvestment. On the other hand, if the system determined a user waslooking at content for less time and/or not revisiting the content, thatmight show they have no questions, and be an indication that thepotential buyer has a greater inclination to invest. Similarly, if abuyer has engaged a large number of personnel widely across all of theinformation on an exchange, this may be an indicator of strong interest,as the user may be moving into the late stages of due diligence prior tomaking a bid. Over time, observations about viewer behavior acrossvarious enterprises and prospective deals can be correlated withresults, such as comparing time spent by winning bidders on theexchange, or on particular types of content, to time spent by otherbidders and time spent by parties that did not elect to bid. Time spentcan be correlated with various results, including winning bidinformation, information about prices, information about transactionalcosts (e.g., determining what types of content appear to create thelargest delays during the deal process or contribute to the greatestcosts). If the system provides this intelligence to people on the sellside of a deal, the seller may make use of the information in making thesale, such as by providing clarifying information about areas ofpotential concern, or initiating discussions over such areas.

The buyer interest index, or other analytic measure of buyer activity,may be developed based on what various users have done in past activity,to provide a predictor of future interest. In embodiments the system mayextrapolate the viewing behavior of users to develop analytical trendsfor behavior of the user, or like users, such as looking at data fromviewing specific documents and making predictions about what a buyer wholooks at particular content tends to do in subsequent actions.

Such an index may apply to a buyer organization as a whole or toparticular individuals or roles within a buyer; for example, an interestindex may apply specifically to a CFO of a buyer, such that interest infinancial documents is likely to be higher than interest in other items,such as intellectual property disclosures. Determinations of similarity,used for purposes of predicting interest, may compare variousattributes, including organizational size, organizational type orindustrial classification category, transaction type, past history ofdeal making, and the like at the enterprise level and may also be basedat the individual or role level, involving comparison of attributesrelating to the individual or role, including past activity history(e.g., tracking that the individual tends to explore the balance sheetand profit-and-loss statement first), level in the organization, tenurewith an organization, past employment history, and many others.Similarity may be determined based on rules (e.g., those with the samerole or title are treated as the same), or by attribute weighting ordistance calculations such as used in various fields to cluster groupsbased on multiple attributes. The system may assign various scores ormetrics to users based on these analytics at the entity or individuallevel, thus providing a seller or a buyer with insight into thepotential for an investment, a purchase, or other transaction. On thebuy side of a deal, tracking of behavior of the seller may provideinsight into various topics, such as a high level of seller activityindicating that a buyer is taking a bid seriously and a low level ofactivity suggesting the opposite. Again for both buyers and sellers,correlations of activity with actual market results over time cansuggest which of these insights are most robust, and various hypothesescan be tested in an analytic environment that collects data regardingentity and individual viewing activity across various transactions forvarious enterprises, collects data regarding transactions themselves(e.g., price, timing, bidding history, and the like), and allowsanalysis (e.g., correlation) of various types on the data sets. Inembodiments, transaction data can be cleaned to remove identifyinginformation for a specific individual, for a specific entity and/or fora specific transaction, including by aggregating data across manytransactions, so that analytic results relating to the impact of viewingactivity can be understood over many transactions, without revealingconfidential data relating to any particular transaction, individual orenterprise.

Mobile Device Interface

Referring to FIG. 9, the mobile device interface facility 218 mayprovide for facilities such that a mobile device 902 can be used whilemaintaining the secure exchange environment provided by the host server102 as described herein, such as for a tablet (e.g. an iPad), a smartphone, and the like, where for instance the mobile device is providedfunctionality provided through the e-signing facility 208, the viewerfacility 214, and the like. Facilities normally provided through thehost server 102 as shown in FIG. 2 may be provided in part or whole onthe mobile device, such that the mobile device may be utilized when themobile device does not have connectivity with the host server 102. Forinstance, the user may be able to login to the same interface as whenthey are working through a non-mobile computer, such as on theirpersonal computer, and see their list of exchanges, all of theirdocuments, all of their contacts, and the like. Using an iPad as anexample, all of the user's documents may be encrypted when sent to theiPad and decrypted for viewing, such that none of the information isdecrypted and stored on the iPad. A user may not be able to print orsave from the mobile device, and be provided with a secure documentviewer, as described herein, such as partial viewing, eye gaze motioncontrol, watermarking, and the like.

A mobile device viewing interface may include various configurations,such as public vs. private exchange views, where certain exchanges arevisible as restricted by public-private declarations, more exchanges areviewed when all exchanges are able to be viewed, and certain otherexchanges are viewable with viewing only mobile exchanges. Variousfunctions can be provided for accessing exchanges, folders, files, andthe like. For example, a message may be displayed if a user attempts toaccess an exchange or entity without the required declaration. Publicvs. private document views may be displayed. Document classification maybe provided, where a document control button may be provided foruploading, an appropriation may be specified, and the like. Public andprivate users and groups may be specified. Document access reports maybe generated. File uploads may be made to various exchanges.

In embodiments, a secure viewing application for a mobile device may beprovided to provide secure viewing 802, such as for a tablet (e.g. aniPad), a smart phone, or a mobile computer. In various embodimentsdisclosed herein, the user of a mobile device may be an employee orother individual associated with a business entity. In embodiments,users may include employees or individuals associated with businessentities that place documents on secure data exchanges as well asemployees or individuals associated with separate business entities thatretrieve documents from secure data exchanges or view or consumedocuments on data exchanges. The entities in each case may further beseparate from an intermediate business entity that hosts one or moresecure data exchanges. The user of the mobile device may be able tologin to the secure viewing application, such as when the user isworking through a mobile device to see a list of exchanges, all of theuser's exchange-related documents, all of the user's exchange-relatedcontacts, or other information, where the application may be resident onthe mobile device. In embodiments, the user may be able to login to thesecure viewing application whether or not the mobile device is connectedto an exchange, while in other embodiments some or all features of theapplication may be limited to situations where a connection to anexchange is maintained, or to situations in which the application hasbeen connected to an exchange within a certain time period prior tousing the secure viewing application. The secure viewing application mayrequire the user to enter a personal identification number (PIN),password, or other indication of authentication (optionally includingbiometric authentication indicators) in order to access the application.

A user may be able to mark a document as a favorite by accessing thedocument from a mobile device, a personal computer, a web portal, anexchange or the like. The secure viewing application may allow a user toview a list of documents that have been marked as favorites. The usermay be able to select an individual document from the list and view thedocument on the mobile device. The secure viewing application may trackwhich documents and versions thereof have been selected and when thedocuments, or versions thereof, have been viewed by users. The secureviewing application may track versions of documents, including when eachdocument version has been viewed by a user, whether or not the secureviewing application is connected to an exchange during viewing, such asby storing relevant data on viewing on the mobile device for delivery toor retrieval by an exchange when the mobile device is connected, or bysending viewing information at the time of viewing from the mobiledevice to the relevant exchange. The secure viewing application maycommunicate the tracked information to an exchange. The trackedinformation may be communicated to an exchange immediately if the mobiledevice is connected to an exchange. If the device is not currentlyconnected to an exchange, the tracked information may be communicated toan exchange when the secure viewing application later becomes connectedto an exchange. A document may be made available by an exchange to bemarked as a favorite by a user. A document may be protected by anexchange to prevent a user from marking it as a favorite fordownloading, and the like. A protected document may be restricted fromoff-line viewing, may be restricted from being screen printed, may berestricted to viewing only by authorized personnel, and the like.

Authorization for viewing may be provided by various methods, such asvia face recognition using an integrated camera or some other type ofbiometric sensing, location-based services, network connectivity, andthe like. As described herein, an integrated camera may be used todetect the authorized user's face, the authorized user's iris, thepresence of other people in the camera's field-of-view, and the like,and when detecting the presence of an unauthorized individual, placerestrictions on viewing, such as described herein. An integrated cameramay be used in conjunction with a view-restricting layer, such as aphysical sheet over the display of the mobile device, such as privacyscreen (e.g., a polarizing filter preventing viewing outside arestricted angle of view) or by manipulation of the display to makeoff-angle viewing more difficult. In this way, the integrated camera ispreconfigured to see any individual that is able to view the devicescreen within the restricted angle of view of the privacy screen.Location-based services may be used to restrict viewing by enabling ordisabling a user's authorization for viewing based on the user'sgeographic location. For instance, the user may not be authorized toview a particular document in certain counties, outside their homecountry, outside a small geographic area around an office of anenterprise, around the user's home, on a known transportation route(e.g., a plane flight on which the user has a reservation), and thelike. A user's authorization for viewing may be determined at least inpart on the network connectivity of the mobile device, such as with theenterprise network, a trusted network, a WiFi network, and the like. Forinstance, a user may not be authorized to download a secure documentthrough a cellular network, such as when they are not connected to aWiFi or wired network connection. The authorization for viewing may be acombination of these and other related parameters, where therestriction-based parameters and settings are controlled through asystem administrator, such as stored in a user profile, determined by apolicy, and the like.

If a user is connected to an exchange through an authorized networkconnection, a user may mark the document as a favorite and the documentmay then be downloaded to and stored securely on the mobile device ofthe user, such as being encrypted and/or provided with anunconventional, dedicated file format that is accessible only by thesecure mobile application. If a mobile device is not connected to anexchange, or if the connection from the mobile device does not havesufficient bandwidth to download the document from an exchange, adocument that has been marked as a favorite by the user may be tagged asa favorite by the user and then later downloaded to and stored securelyon the mobile device of the user when the user becomes connected to theexchange and the connection has sufficient bandwidth. The postponeddownload may happen automatically or it may happen after the user laterinitiates the download or confirms that the download is still desired.The secure viewing application may alert the user that the download istaking place, provide the user with a download progress indicator, ordownload the file in the background without alerting the user.

The document may be downloaded over a secure connection between theexchange and the secure viewing application. The document may be storedin a secure location that may be accessed only by the secure viewingapplication, an encrypted memory location, or an otherwise securedmemory location. The encryption used may be any encryption scheme knownto one skilled in the art, such as AES 128 encryption, AES 192encryption, AES 256 encryption, and the like.

A document may be constrained on an exchange such that it may only beaccessed through the secure viewing application, or access may beallowed through any application that is compatible with the format ofthe document. In embodiments the document may be accessed by the secureviewing application whether or not the user is connected to an exchange.A setting may be provided, which may be selected by an administrator, toallow the administrator to restrict how or when a document can beaccessed. For example, a setting may allow a document only to beaccessed by the secure viewing application. Another setting may allow adocument to be accessed by both the secure viewing application and anyother application that is compatible with the format of the document. Inembodiments the setting may be configured by the administrator of anexchange, such as working within an intermediate business entity orworking for an entity that places documents on an exchange. The settingmay be selected for an individual document, a document folder, or agroup of documents. A document that is made available to be accessed byany application that is compatible with the document may be edited byanother application and saved back to an exchange through the secureoffline mobile application.

An exchange may verify changes to documents through indicators ofmodification, or “modification stamps”, on the documents that have beenmarked as favorites by a user. Such indicators may indicate when changeshave been made to items accessed through an exchange, so that adetermination can be made whether any modification has occurred to adocument, file, etc. between the time the user last connected to theexchange. Modification stamps may take the form of metadata stored in orassociated with a document, file, etc., a tag, or similar facility fortracking status or state information. An exchange may verify themodification stamps on the documents that have been marked as favoritesby a user when the user connects to an exchange and logs into the secureviewing application. A document may be deleted from the mobile device ifits modification stamps indicate that the version of the document on themobile device is not the current version. A document may be marked asbeing out-of-date when a user logs into the secure viewing applicationif it is not the most current version of the document. In embodimentsthe out-of-date document may be visible to the user. The out-of-datedocument may include an indicator to communicate to the user that thedocument is not the current version of the document. Access may bedenied to an out-of-date document. The current version of the documentmay be downloaded. Download of the current version may happenautomatically or upon user request or upon a confirmative response to anoffer for the current version. The user may immediately download thecurrent version at the time the user selects the document for viewing.The download may take place whether or not the user is logged into thesecure viewing application. A visual indication may alert the user thata document is being downloaded. The user may not be able to access adocument if the download of the most recent version of the document isnot completed before the user disconnects from an exchange.

A secure viewing application may be provided, and may include a screenasking a user to setup a PIN, a screen that prompts a user to enter aPIN, and a screen that is used by a user to select a setting. Theapplication may provide a list of various documents that have beenselected as favorites by a user connected to the exchange, as well asother documents that are selected by a user and loaded for viewing. Ascreen of the secure viewing application may allow a user to select adocument as a favorite when the mobile device is connected to anexchange. A screen of the secure viewing application may allow a user toselect a document that is made available through the secure viewingapplication and is available to be opened in a different application.Various documents may be made available for a user to view when a mobiledevice is not connected to an exchange and the mobile device includes asecure viewing application.

The secure offline mobile viewing application may be employed when auser desires to access a document, especially one that is subject tofrequent revision, when there is no connection between the mobile deviceand the exchange The secure offline mobile viewing application may alsobe used in situations when a document is subject to a corporate policywhich requires access to only the current version of a document. Thesecure offline mobile viewing application helps to ensure compliancewith corporate policies that require prevention of access to supersededdocument versions and may be used as proof that the user accessed thecurrent version of the document. The secure offline mobile viewingapplication also permits users to collaborate on documents with otherusers through an exchange, when the documents are not subject to anycorporate compliance requirements with regard to version accessibility.

In embodiments, the present invention may provide for technology aspectsrelated to architecture, structural components, facilities, data,communications, analytics, reporting, materials, inbound components,processes, algorithms, and the like. Architecture, structuralcomponents, and facility may include multi-language support, metadataassociation, document content processing, document content distribution,distributed geo-storage, and the like. Relationships among componentsmay include CRM integration, sales force connector, HCM integration, ERPintegration, ECM integration, e-Learning integration, and the like.Data, communications, analytics, and reporting may include user historyreporting, activity reporting, permission reporting access reporting,audit and compliance reporting, configurable dashboards, self-servicereporting (e.g. custom, scheduled, ad-hoc), IMAP folder management,exadata integration, and the like.

In embodiments, the present invention may provide for product aspectsrelated to features, attributes, benefits, outputs, functional benefits,security, and the like. Products may include integration from a securedata room, public-private bifurcation in the loan market, secure mobiledevices, and the like. Features, attributes, and benefits may includeiPad protected documents, bounce-back reporting, branding, channels,alerts, task management, multi-task process management, automaticindexing, migration, automation (e.g. ILIA automation), specialization(e.g. custom fields, custom workflow), very large file support, documentmanagement (e.g. review and approve, check-in and out, version control),customizable user interface, unified inbox, and the like. Productfeatures may include custom alerts, buyer utilities, bulk addition offiles and folders, dynamically indexing information, advanced andfederated search and filtering, custom fields and tags, integration withthird-party document formats (e.g. Microsoft Office products), add andmanagement of users and groups, multi-file uploads, commenting,compliant archiving, native-format file viewing, business intelligencebased on activity reporting, question and answer components, linkmapping, secure viewing without plug-ins, unified communication andcollaboration (e.g. presence notification, IM-chat-discussion threads,forums and wikis), administration capability, e-forms, and the like.Security may include on-demand rights management, access andauthentication (e.g. document and content level access, multi-factorauthentication, single sign-on), data encryption, tracking and audit,intra-structure security (e.g. systems protection, security audits),personnel security, process security, encryption, watermarking, and thelike.

In embodiments, the present invention may provide for market aspectsrelated uses, applications, environments of deployment, use scenarios,ecosystems, value chains, system integration, and the like. Applicationsmay include corporate repository, extended team collaboration, managedfile transfer, secure extranet, project lifecycle management, boardreporting, legal extranet, legal repository, legal collaboration,managed file transfer, regulatory audit and reporting, secure extranet,financial audit management, fundraising, investor communication,contract management, regulatory filings, board of directors'communication, Compliance feed integration, access gatekeeper, projectcapital finance, project collaboration, supply chain management,contract manufacturing, and the like. Markets may include finance, loansyndication, M&A (e.g. relationship management and marketing activities,client interactions, sending legal documents and contacts for comment,edit, and signature), alternative investments, commercial banking,investment banking, bankruptcy and restructuring, corporate development,construction, life sciences, pharmaceutical, biotechnology, energy andutilities, utility rate case management, insurance, telecommunications,project life cycle management, information technology, legal services,government, manufacturing, real estate, media and entertainment, and thelike. Environments of deployment may include corporate development,corporate repository, corporate finance, corporate legal, engineering,human resources, marketing, general services, research and development,compliance and security, line of business, and the like. Use scenariosmay include, bankruptcy and restructuring, board reporting, businessdevelopment and licensing, clinical site activation, extended teamcollaboration, fundraising, initial public offerings (IPOs), investorportals, investor reporting, legal extranet, managed file transfer,mergers and acquisitions, private placements, project lifecyclemanagement, regulatory audit and reporting, regulatory case management,safety document distribution, secure extranet, structured finances,syndicated lending, virtual data room, and the like.

Sharing and Un-Sharing

Current methods for sharing computer files are not adequately secure inthat a user may make errors in sending information, such as with asingle, errant click, and send sensitive information into the wronghands with no way to recover the sent materials. Alternately, sensitiveinformation may be provided to a trusted associate that subsequentlyleaves a company or department, to a vendor where the user's companysubsequently switches vendors, to someone outside the company that issubsequently identified as a risk to the spread of sensitiveinformation, and the like, where the sender would like to revoke accessto the shared content. The present invention may provide for methods andsystems for securely sharing content (e.g., computer data content, suchas documents, presentations, spreadsheets, emails, blog entries, texts,calendar notes, meetings, social media messages, browser history,bookmarks, and the like) that allows for ‘un-sharing’ of content thathas been previously shared. The facility to un-share content may beimplemented through the content being associated with a secureprotection feature, such as through digital rights management (DRM),encryption, permissions, and the like. In embodiments, each content itemmay shared with the protection feature, where the protection featurespecifies a user or group of users that are authorized to access thecontent for viewing. Then when the content is shared with that user,access to the content may be revoked at any time (e.g. by changing theDRM, removing access to the key, changing permissions, and the like).Further, if the sender of the content controls the protection feature,then the sender has complete lifetime control of any content theydistribute or provide access to.

The secure un-sharing facility may be used to securely share contentbeyond the secure protective facilities of their enterprise (e.g.,allowing secure sharing beyond the firewall of the sender's enterprise),out to users in other companies, into the public space, to users notintended to get the content, and the like, where the sender maintainscomplete control to access of the content, no matter where or to who thecontent has been distributed. In this way, the secure sharing of contentis made to be easy across corporate boundaries at the user level and atthe individual content level (e.g., at the level of an individualdocument). Further, the process allows a user wishing to unshare contentto be discrete in its execution, allowing the sender to revoke accesswithout having to contact or to track down the recipients, who may nothave any indication sent to them that access has been revoked. With theunsharing facility, the content simple stops being accessible. And therevoking of access may be for not only the original content, but for allinstances of the content, such as copies stored on various devices andcomputer environments (e.g., stored on desktop computer, tablet, mobilesmart phone, in an application, through a web browser, and the like),copies sent to third parties, and the like. And since the protectionfeature may apply to all versions that have been modified (e.g., editedversions, redline versions, commented versions, signed versions, and thelike), access to modified versions of the content may also be revokedwhen the access to the original content is revoked.

In embodiments, access to a shared content may require an accessauthentication to a secure facility, such as the secure exchange server.That is, even if content has been shared with a user, the user may onlybe able to view the content if their access is authenticated.Authentication may be a manual login to verify that the user attemptingaccess to the document is a user that is listed to have access to thecontent. Alternately, a user that has access may establish a computerdevice that is tied to their personal authentication, such as throughthe secure facility. For instance, an authorized user may associatetheir personal authorization to their portable computing device (e.g.,tablet, smart phone), such as where the portable computing device has apassword to access the device, thus ensuring that the person requestingthe access from the mobile device is the authorized user.

In embodiments, the security process that protects the content, such asa document to be uploaded and shared, may incorporate a plurality ofprotective steps. For example, when a document is uploaded a virus scanmay be run, permissions may be established, a search index may becreated, digital protection may be applied, the document may beconverted (e.g. formatted), the document may be encrypted, and the like,where encryption may be applied individually to each new content, suchas through a randomly generated encryption key. When a download of thedocument is requested, such as when an authorized user is downloading aspart of the document being shared, a random key with a key ID may begenerated for that particular document where the document is encryptedwith the random key. A master key may be split between a database and afile system, where the encrypted random key and random key ID are storedin the database, and the random key may be encrypted with the masterkey, and the like. Permissions, virus scan, watermark, digitalprotection, and the like may then be applied before delivery of thedocument.

In embodiments, the un-sharing facility may enable the control of accessdown to the individual content level, such as with the creation of a newdocument, which may be part of or be the start of a collaborative socialwork stream, allowing users to share content, and then initiate andperpetuate conversations and interactions around those contents. Socialwork streams may support discussion threads, activity streams, and othercommon social interaction facilities, which may utilize the content asthe organizing basis. The process of un-sharing a content may resultfrom removal of the content from the work stream, retiring the workstream, removing the individual content entirely, and the like.

The present disclosure describes a secure content sharing andproductivity solution for organizations to share confidential andnon-confidential content between and amongst enterprises over a globalcommunication network such as the Internet, including outside enterprisefirewalls. The present disclosure may provide a secure content sharingand collaboration environment that goes beyond the enterprise firewall;establishing a seamless dual-use user workflow environment thataccommodates both secure and personal exchange of content without theneed for the user to adopt substantially new workflow process andapplications; providing secure interfaces for viewing documents usingmobile computing devices, such as touch-interface tablets (e.g.including the incorporation of personal user devices); and the like.

The need for beyond-the-firewall content sharing space has been createdby the confluence of technology evolution (e.g. cloud computing andvirtualization, portable form factor innovation, ‘big data’ BI tools),organizational shifts (e.g. rapidly growing cross-enterprisecollaboration, global fragmentation of enterprise, cross-functionalteams, demographics shifts), changes in the role of integrationtechnology (e.g. cost and complexity reduction, pressure for measureablebusiness value, ‘computerization’ of enterprise IT and ‘bring your owndevice’), government and regulatory issues (e.g. increasing regulations,cyber security threats), and the like that collectively increase theimportance of easy and secure collaboration of documents and contentbeyond the enterprise firewall. Other solutions have taken a variety ofapproaches to address fragments of these requirements, but importantunmet needs remain for information technology directors, businessleaders, and users remain, including in the areas of integration ofsecurity/control, ease of use, seamless operation across different waysof sharing, and the like.

In embodiments, the system may include methods and systems for providinga single fabric to enhance the most common forms of beyond-the-firewallcontent sharing, improving individual and team productivity across theextended enterprise while providing unified security and compliance forIT and business leaders; allow users to continue beyond-the-firewallsharing however they prefer with a single user interface enhancing thesecurity and productivity of e-mail, sync-and-share folders,externalized enterprise content management, and enterprise socialcollaboration tools; integrate with consumer-focused sync-and-shareservices where possible to enable their secure and compliant use withinthe enterprise; enhance forms of collaboration to which users arealready accustomed, and not require adoption of a new way of working orcollaboration destination; target the unique collaboration and sharingrequirements of the extended enterprise and complement other enterprisesystems; and the like.

In embodiments, a need for a comprehensive sharing system may include anease of use and intuitive user interface; with granular securitypermissions, to help ensure that unauthorized individuals can't opendocuments; ability to control content post-sharing (e.g. the ability topull back a document), enabling a user to recover and destroy dataremotely, such as in using a virtual data room; productivity toolsintegrated with content sharing, consolidating a plurality of userlog-ins and passwords; the ability to integrate with existinginfrastructure, to eliminate the need for a plurality of sharing tools;providing multiple channels for collaboration in order to integrate themethods and systems into as many productivity platforms as possible; andthe like. For instance, with a single user action within the userinterface, the user may be able to revoke access to a shared file orresource, regardless of where the file or resource is stored, thusproviding an enterprise workforce the freedom to share, as well as theability to un-share. In addition, reporting of actions may include audittrail facilities, such as at the gateway level, and governance,including policies embedded in workflows. Collaboration may be providedwith significantly reduced risk through tools provided by enterpriseinformation technology personnel, thus reducing the risk of employeessharing sensitive documents outside the firewall (e.g. through email,USB transfers, FTP, through third-party services, web/cloud filesharing, and the like). Security may provide additional protection, suchas through IRM, encryption, and the like. The sharing facilities mayinclude sync and share functionality, workflow tools, businessintelligence, and the like, and provide greater secure connectivity andproductivity, improving the workflow in association with customers,suppliers, partners, professional service organizations, businessprospects, and the like. Thus, methods and systems disclosed herein mayinclude client and server-side, as well as cloud-deployed components,for managing access to resources, including based on policies associatedwith such resources, as well as such components for tracking, reporting,and managing access to resources, such as to keep consistent,synchronized versions of such resources across multiple access devices.

Content Access Management

Referring to FIG. 10, the present disclosure describes an exchangecontent access facility 1008 (content access management facility 251 asin FIG. 2a ) in association with the secure exchange server 1002 thatimproves the security with which a plurality of users 1004 collaboratefreely, including through a plurality of different content sharingdevices and facilities, while providing lifetime control of theircontent. For example, suppose a user sent quarterly sales data to an oldaccounting firm, employee records to someone outside of HR, the wrongcontract to the wrong vendor. When a user ‘un-shares’, content accessmay be instantly revoked, including any content that may have been fromcopies of the original content. In embodiments, the user may have totallifetime control of each and every content item, such as documents,emails, communications, and the like. In embodiments, the content may bestored and tracked in a secure database 1012. Users may share and revokeaccess to content all the way down to the document level, providing asecure place to upload files and share them across devices. In this way,users may be provided a secure storage facility for company sensitiveinformation, where users are able to work more securely, such as withtheir existing infrastructure (e.g. seamless integration withapplications like Microsoft Outlook, SharePoint, and the like). Theun-share facility may allow a user to create a new work stream, securelyupload the documents, and work with teams that are enabled to securelycollaborate. In addition, the un-sharing facility may provide forreports, audits, summaries, and the like through a dashboard facility,such as a summary view of all work streams, customized securitysettings, ability to add new participants, provide automated reporting,and the like. The exchange content access facility 1008 may utilize auser login data authentication facility 1010 to authenticate users'access to content, where there may be the option of having a singlesign-on in association with other user logins. In embodiments, the loginmay utilize security hashing in a redirect URL, such as to secure thelogin against Phishing attacks. The single sign-in may extend to mobiledevices, including personal mobile devices, were a lookup table may beused to verify that the user has single sign-on capabilities or not.

In embodiments, a method for managing a networked secure collaborativecomputer data exchange environment may be provided. The secure exchangeserver 1002, such as managed by an intermediate business entity, mayestablish a user login data authentication procedure that allows a userto access the secure exchange server, where the secure exchange servermay store user login authentication data for each of the plurality ofusers, such as in a secure database. Users may access the secureexchange server through a plurality of different computer devices,applications, communications channels, and the like. The user may be oneof a plurality of users 1004 that work for a plurality of other businessentities (e.g., users may be employees of the same business entity orusers may be working for different business entities), where the usersof the other business entities communicate with the secure exchangeserver through a communications network, such as a wide area network(e.g., the Internet). To share a computer content item, a first of theplurality of users may request a sharing access from the secure exchangeserver to a content item to at least a second of the plurality of users.Management for access to the content may be through an exchange contentaccess facility 1008 managed by the intermediate business entity. Afterthe exchange server receives the content from the first of the pluralityof users, it may grant sharing access to the content when the secureexchange server receives from the second of the plurality of users itsclient login authentication data (provided that the second of theplurality of users is one of the subset of the plurality of users towhich sharing access is permitted). The second of the plurality of usersmay then request a copy of the content from the secure exchange server,wherein a copy of the content is made. Further, the second of theplurality of users may further copy the content onto a plurality ofdifferent computing devices, make changes, revisions, annotations, andthe like to a new version of the content, send the content to otherusers, send the content to people and computing devices beyond theboundaries of the business entities, and the like. To un-share thecontent, the first of the plurality of users may then make a request tothe secure exchange server to revoke sharing access to the content tothe second of the plurality of users. As a result, the secure exchangeserver revokes access by the second user to the content, such as throughencryption and DRM facilities described herein. Further, this revocationof the second user's access to the content may similarly be applied toall instances of the content within the plurality of users, wherein therevoking of sharing access to the content revokes access to allinstances of the shared content and all copies of the content made bythe plurality of users. In a similar fashion, any individual that doesnot have authority to access the content may not have the ability toaccess any instance of the content. In embodiments, copies of thecontent may be deleted from the secure data server, wherein the deletingaccess to the copy of the content is revocation of digital rightsmanagement of the content. The digital rights management of the contentmay be controlled in part by the first of the plurality of users,including revoking access to the content through changes in the digitalrights management associated with the content. The content may be asecure encrypted content. Users may securely view the content through asecure viewing facility. Users may be connected to a public network thatis outside of the firewall for the business entity that manages them.Users may access the content through a personal computing device that isnot owned by the business entity that manages them, such as through apersonal computer, personal mobile device, and the like. Users through adashboard facility may interface the exchange content access facility,where the dashboard facility may provide reports showing activityrelated the sharing of content. The dashboard facility may be accessiblethrough third-party environments. The dashboard facility may track thelocation and version of the shared content on computing devicesaccessible by the at least second of the plurality of users.

FIG. 10A provides a non-limiting example of how the present inventionmay provide an improved workflow between collaborating individuals. Inthis workflow scenario, an enterprise knowledge worker ‘Fred’ (e.g.internal counsel) is collaborating with a chief information officer‘George’ who works at the same company as Fred, and an external partner‘Pam’ (e.g. external counsel). As shown, in a first step 1021, Fred maysync files from his personal computer, such as with resources in thecloud. These resources may include syncing with virtual secure data roomfacilities, third-party computer sync facilities that are compatiblewith the present invention, and the like, and may be made availablethrough the dashboard facility. In a second step 1022, Fred may alsoaccess his files and have the ability to sync to devices that George hasapproved, such as through a virtual secure data room, an enterprise orshared enterprise policy facility, and the like. In a step three 1023,Fred may view status of a project he and Pam are working on, such asthrough the dashboard facility. As part of a process template, he may bereminded to send a file to Pam for review. In a step four 1024, Pam mayreceive the file on her iPad, where she opens it to review, such asthrough the mobile device viewing facility. In a step five 1025, Fredmay now want to share some confidential files with Pam, such as though avirtual secure data room facility, with the ability to ‘pull-back’ thedocument from Pam at anytime through the un-sharing facility. Inaddition, Fred may task Pam to annotate, review, markup, revise, and thelike, the file he's sharing, such as through a content creationapplication (e.g., word processor, spreadsheet application, presentationapplication, media tool), the amendment voting facility, the e-signingfacility, via the secure viewer facility, and the like. In a step six1026, based on content inspection and destination, Fred may see hisactions are risky and decides to remediate, such as by un-sharing thedocument from Pam's access, as implemented through the dashboardfacility, and the like. He may then, for instance, choose to share thefiles as read-only. In a step seven 1027, Pam receives systemnotification on her Macintosh computer, such as through the dashboardfacility. In a step eight 1028, Pam annotates the read-only file in theMac application, and competes the task, such as through an applicationthat Pam is familiar with and integrated for ease of use in the familiarworkflow environment created by the present invention. In a step nine1029, Fred sees that Pam has finished her task, such as though thedashboard facility, opens the annotated file and syncs (e.g. viaSharePoint). In a step ten 1030, Fred manages teamwork items against aschedule, and with all tasks competed, closes the project. For instance,the project may have been a loan syndication project, and once complete,Fred may completely eliminate accessibility to documents andcommunications that were transmitted during the transaction, such asremoving access to any documents that were transmitted during executionof the project. In a step eleven 1031, Pam may also revoke files whenthe project is completed, and files are wiped from her devices, such asthe system pulling back the files as tracked by the system in a securedatabase created for the project (which in itself may be deleted oncethe project is complete). In a step twelve 1032, George may see riskysharing activity in his security event management system, and in a stepthirteen 1033, see compliance reports and audit information in agovernance, risk management, and compliance (GRC) system, such asthrough monitoring via the dashboard facility. In embodiments, aworkflow thread may be initiated within an exchange amongst otherbusiness entities, with selected individuals in a micro-transaction,from an email thread, and the like. In embodiments, a user may beenabled to create a concept of a big project and use micro-transactioncapabilities to break the big project down into smaller projects thatcan link back up to the big project. A user may be able to create tasksout of their email inbox, turn an email thread into a task, clear a taskby converting the email into a work-stream, make an exchange anextension of an email, and the like.

In embodiments, the system may provide for the ability to remotelydelete content from a device while the device is off-line or notconnected to a network. This capability may be implemented by providinga lease to a desktop application when it starts up and has a successfullogon, such as configured by a policy through an administer console.When a device is powered up and a lease period is expired without asuccessful logon during the lease period, the system may initiate adeletion of files, such as would be the case if the device had been lostor stolen. This application may be a separate desktop service running onthe device in the background (e.g., sleep and awake in pre-defined timeintervals). When a device is powered up, the application may record thevalues of a lease expiration date/time of a previous successful login.In another instance, the service may try to connect to a server, and ifit detects connection failures continuously past the lease expirationdate and time, it may assume that either the device no longer needs torun the application, or it could be lost or stolen. In the case of thedevice that is subsequently found or re-used, the content may bere-synced for the user once they login to the application successfully.There may be hard or soft leases implemented in the system. In theinstance of a hard lease, files may be deleted permanently on the localmachine when the lease is expired. In a soft lease, rather than deletingdata, the system may move the data to a random location on the diskwhere a user cannot find it. For example, the system may modify thefolder attribute for the data, such as to “+ S+H”. Setting thoseattributes will mark it as an important operating system file so thatthe operating system won't display the data even if settings allow thedisplay of hidden files and folders. In embodiments, the system mayprovide for automatically deleting documents, whether the device isonline or not, based on a date/time range. For instance, setting a rangeof dates for the life of documents to be between on date/time andanother, at which time all related documents and folders are deleted.The system may also delete documents, folders, desktop, and the like,after a predetermined number of login failure attempts, where the systemmay provide access again upon restoration of access privileges.

In embodiments, the system may provide for remotely deleting documentsthrough a limited local access facility, where the user may have accessto a document, folder, and the like, only through an encrypted localapplication. In this way, files stay encrypted on a user machine and theonly way to access them is to use the application that will decrypt thedocuments. The local application may also be embedded, as describedherein, such as through a browser, where a user may only be able toaccess documents with credentials that tie to the encryption key. Thelocal application may be a viewer application, where documents aredistributed through a distribution engine, but where the user can onlyview the documents using the viewer that would decrypt the document forviewing.

In embodiments, the system may integrate the sharing capability withother third-party environments, such as including existing file sharingsolutions (e.g. Dropbox, Google Drive, Skydrive, Box.com, MediaFire,SugarSync, TitanFile, YouSendlt, SparkleShare, Ubuntu One) providingcloud storage, file synchronization, client software, and the like. Inaddition to sharing resources, the present invention may also provide a‘share’ option within other third-party day-to-day workflow solutions,such as desktop tools (e.g. Microsoft Office, iWork, Google Docs,OpenOffice, and the like) and enterprise tools (enterprise DBs, CRMtools, analytical tools), and the like, where without departing theinterface of the third-party tool or application, the present inventionmay allow content to be shared outside the enterprise with anotherparty, but with the secure data room and secure viewing features asdescribed herein (e.g. the ability to track access and viewing, abilityto have ‘read only’ viewing and annotation, secure viewing on a mobiledevice, ability to pull back a document), and the like. Further, thepresent invention may be able to interface with templated secure sharingprocesses, such as by having input events and output actions consistwith those (e.g., Outlook receives an email from a secure process andsignals an action; LinkedIn lets a user view and approve a corporatevoting item).

In embodiments, the system may enable an organization to maximize thevalue of content by balancing the freedom to share with the necessarycontrol and monitoring provided by the system, which extends the way anorganization works, such as by allowing them to share and access contentwherever it is needed, controlling and monitoring content wherever itgoes, coordinate work across people, organizations and devices as anatural extension of familiar tools and experiences. The system mayprovide for a full-service, global facility as a ‘partner’ wherever theuser may go, providing visibility and control of work-centric content,freedom to collaborate, and the like. The system may provide a trustedstandard for information security ‘beyond the firewall’, providingautomation and monitoring of corporate information policy, extending afamiliar user experience and existing infrastructure, and the like.Collectively, the methods and systems of the present invention mayprovide for an intent-based sharing ‘fabric’ for enabling comprehensivecollaboration.

In embodiments, the system may provide for improved connectivity,security, productivity, and the like, as related to a sharedcollaborative work environment. Productivity may include the ability toassign and manage document-centric business actions (e.g. e-signature),project task management, and the like, such as to provide morestructured document sharing platforms (e.g. more than just email, whichmay be an ad-hoc communication). Security may include role andfile-based permissions, outside the firewall pullback of documentpermissions, automatic document content and security classification, andthe like. Connectivity may include single secure connection to documentsharing tools across devices, secure access to internal ECM platform forexternal parties, integration of enterprise-class security into existingsync-and-share tools, and the like, such as to enable access anywherethe client needs it and the ability to make updates to documents easily,regardless of where the user is located. The system may provide advancedanalytical features to improve productivity, such as audit compliance,document versioning and tracking, document contextualization, historicalperformance analysis, predictive analytics, task productivityoptimization, and the like. The system may also include socialcollaborative features to improve interactions within projects, such asimproved communications within the workflow, secure project management,tablet-based collaboration, synchronous co-editing, socialcollaboration, a social layer around business applications, and thelike.

In embodiments, the system may provide for synchronization and sharingfor the individual business professional, including a plurality ofchannels (e.g. Windows desktop client, web browser, Microsoft Outlookfor Windows, iOS support (such as a native app for the iPhone andiPad)), features (e.g. desktop file and folder synchronization; securefile sharing from desktop, browser, and iOS; push notifications,collaborative discussion threads and commenting; user self sign-up), forwork with business intent (e.g. sending a copy for download, sharingaccess to a centrally located file for review), administration (e.g.canned activity audit reports, such as for compliance; canned accountingreports, such as for billing); centralized group policy, such as forsecurity defaults), security (e.g. with strong, per-file encryption andpermissions; browser-based, read-only file access; integrated fileinformation rights management (IRM) and digital rights management (DRM);file access revocation; mobile device security; full compliance audit),and the like. The term ‘work with business intent’ may include theability of users to share files ‘with intent’. For instance, the intentmay come in the form of document tasks that may be assigned torecipients, where the system may let users send files for review, sendfor signature, send for annotation, comment, and the like. For instance,the system may want to give users the ability to combine document tasks(verbs) into ad-hoc workflows and save as a template, which may also bereferred to as a verb cluster. In an example, if a manager has to getslides ready for a board of directors (BOD) meeting, they may start up a“BOD” workflow that included several document tasks and individualsresponsible. One employee may get a task to comment on the slide deck,another gets a task to review and approve the material, and the managergets a task to sign the document for auditors after the first two tasksare completed.

In embodiments, the system may provide for document collaboration andintent-based ‘work’, including a plurality of channels (e.g. nativeAndroid, iPhone, and the like support; plugins for Microsoft Officeapps; SharePoint Connector integration; Mac Client (such as file/foldersync)), features (e.g. desktop file and folder synchronization for Mac;file sharing with intent, such as for document-centric work assignmentand task management; calendaring; in-document task completion;collaborative editing and annotation; ‘in-app’ publishing andcollaboration, such as check in/out), for work with business intent(e.g. work items such as send for review and approval, send for feedbackand annotation, request edits to a document, send for electronicsignature, request form completion), administration (e.g. bulk useradministration through active directory, UI customization and branding,report creation and scheduling), security (e.g. device registration,data loss prevention filters, such as reminders to users when they sharefiles in a risky way; remote device wipe), and the like.

In embodiments, the system may provide for enterprise integration andbusiness process management, including a plurality of channels (e.g.published integration API, third-party app integration, Outlook forMac), features (e.g. work template creation, team collaboration spaces,milestone and project management, in-browser document editing), for workwith business intent (e.g. work item customization, such as combiningdocument tasks to create lightweight ad-hoc business processes),administration (e.g. user and administrator-authored business process),security (e.g. data loss prevention, such as blocking unsafe actions;security information manager (SIM) and security event manager (SEM)integration; customer managed encryption keys; governance, riskmanagement, and compliance (GRC) system integration), and the like. Forinstance, disclosed features (e.g. an un-sharing feature to pull backdocuments as described herein) may be embedded into daily use tools,such as into communications software (e.g. Microsoft Outlook, Gmail),browsers (e.g. Windows Explorer, Firefox, Safari), Enterprise ResourcePlanning (ERP) applications, legal systems, collaboration systems, andthe like, and to make it easily available and easy to use. All thesesystems have a need to distribute documents outside the enterprisefirewall to users who are not logging into these systems on a dailybasis, and by embedding these capabilities enables users for securesharing, auditing, compliance, and the like for documents within userapplications. In an example, suppose sales personnel are building aquote for a customer in a third-party application, such asSalesforce.com for instance. Typically, users would have the ability toemail the quote directly, or to download the document and email it,where there is no audit or compliance within the third-party applicationfor these quotes. With the use of an embedded capability, the documentwould be sent directly from the third-party application with thesystem's secure sharing audit and compliance capabilities, ability topull back (un-sharing) documents, and would be available from within thethird-party application. The embedded service may have the standardcomponents to make this service possible, such as SSO authentication,file viewer, policy definition, auditing, device provisioning, userprofiles and compliance, and the like, where these would be built like aservice and may be integrated directly into the standard enterpriseapplications. Security rules may also be implemented in the embeddedsystem, such as with a range of security (e.g., ranging from public tohighly secure), screen capture and viewing protection, device control,auditing enforced, and the like.

Encrypted File Format for Desktop Access to Enable Secure “Un-Share”

In embodiments, a sharing process may utilize encryption to make theprocess of sharing documents, files, and the like, more secure;otherwise, downloaded shared documents may reside unsecured on thedestination system, such as on a client device of the destination user.In embodiments, a document may be provided for download only in anencrypted format, and the exchange systems disclosed herein may providea desktop tool, such as a viewer, that manages access to the encrypteditems and tracks all actions taken by the destination user with respectto the encrypted item. The viewer may be provided, for example, via aweb interface, so that the shared viewed content and the like viewed inthe viewer, and the functionality for the viewer (other than basicbrowser features) resides on the host system, or the system of the partyproviding the secured item. Thus, the viewer, or its functions, may becontrolled by the host or the party providing the secured item, such asbased on policies that apply to the destination user's access; thus, theshared document is secured by the control of the viewer. In embodiments,‘un-sharing’ is enabled by removing the ability of the destination userto decrypt the document, at which point the document, althoughdownloaded, becomes inaccessible. This may be accomplished, for example,by changing the encryption for the item, removing the user's accessrights to the viewer, or initiating deletion of the secured item by theviewer. Un-sharing may be triggered based on a policy, based ontime-based factors (e.g., access is provided for a limited time), basedon a requirement that the destination user re-establish credentials touse the viewer, and the like. In such embodiments, a shared document mayreside, encrypted, so that the existence of the document can be viewedon the destination user's system, but the contents may be viewed only ifa remotely controlled viewer or desktop application is there to allowthe content to be viewed or played. Such methods and systems may beeffective within an enterprise, such as when a user brings the user'sown device. By remotely controlling a viewer that is necessary to view afile, files residing on such devices are more secure notwithstanding anenterprise's lack of control over the user's device.

Time-Based File Deletion (Time Bomb)

In embodiments, methods for a time-delayed automatic file deletionfacility 215 may be provided that trigger the deletion of a file after aset period of time after the file (e.g., any digital content) movesbeyond a pre-defined boundary parameter, such as a network boundary(e.g., beyond a trusted network), a geographic boundary (e.g., anational boundary), an enterprise boundary (e.g., beyond the network(s)of an enterprise), a device boundary (e.g., the document is only allowedto be on a specified machine or machines), a time boundary, and thelike. In an embodiment, in order for the file to execute the automaticdeletion, the file may have a time-delayed automatic file access policyembedded with the document. In an example, a document may be encryptedand provided with a policy that determines under what boundaryconditions a timer for file deletion is set, and for what duration thetimer may be set. Once the timer has elapsed, a deletion function may beexecuted, such as some form of encryption change, encryption keyholdback, password change or holdback, or the like, making the documentinaccessible, and thus effectively deleted, or the item may be simplydeleted from the machine. In another example, the document may not bepermitted to leave a specified enterprise network, and the timer may beset, such as for one hour. If an employee leaves work with the fileloaded on the employee's laptop, one hour after the enterprise networkconnection is lost, the document may be automatically deleted, such asthrough a detection that the network connection has been lost and thetimer has expired. However, if the employee only lost network connectionfor thirty minutes, the document would not be deleted. Under thiscondition, the timer may be reset for another potential event. Inanother example, the policy may declare that a new password, encryptionkey, or the like, is to be sent to either the document itself or to theauthorized access user every set period of time. In the event that thenew password is not received, such as because the document is now beyondthe pre-defined boundary, the document would not receive the necessarymeans for unlocking the document, and can no longer be opened, and assuch is effectively deleted though inaccessibility. In another example,a permanently infected file may destroy itself when the set period oftime elapses. This time-delayed automatic file deletion process providesa composite protection scheme, where (1) a digital content is protectedfrom moving outside a pre-defined boundary, and (2) once outside theboundary access to the content is not immediately terminated but ratherdelayed by a period of time, thus allowing the content to be temporarilyoutside the protective environment without the content being deleted,made inaccessible, and the like.

Time Bomb De-Fuser

In embodiments, a method may be provided that enables an authorized userto disable the time-delayed automatic deletion of content, where theauthorized user is able to prevent the automatic deletion, undo thedeletion, recover the content after deletion, and the like, where‘deletion’ may be a deletion, a denying of access, an encryption elementchanged or held back, and the like. For example, an authorized user mayhave access to a facility that enables the user to recover the contentafter it has been ‘deleted’, such as through a recovery password,recovery encryption key, recovery application, and the like. In thisway, a file would be secure if the boundary and time conditions havebeen violated, but recoverable if the authorized user deems it secure,or if the content is again within the secure boundary.

Watermarking

In embodiments, a document that is shared may be marked with sharinginformation, such as incorporated in the document's associated metadata,so that the system is able to use this information to implement sharinglimitations, restrictions, controls, and the like. This information maychange as the document undergoes access events, such as viewing,sharing, signing, copying, revising, and the like. In embodiments,sharing information may also be visually presented through awatermarking facility 217, such as in the form of a watermark on thedocument, such as to indicate that document is confidential, restricted,public, private, and the like. The watermark may also indicate theconditions under which users may access and or view the document,including restrictions on individuals, applications, enterprises,geographic location, and the like. The watermarking may be especiallyuseful for viewing documents through a mobile device. For instance, awatermark may include information related to the user that is viewingthe document, such as the user's name, the date and time of viewing bythe user, and the like. Watermarking may also include any other accessand/or viewing limitations and actions for the document. For instance, awatermark may indicate who and when users have viewed the document, whatusers have signed the document, what user created the document, and thelike. In embodiments, information included in the watermark may bedetermined though a policy, by the sender, by the creator, and the like.

Question and Answer Management

In embodiments, a question and answer management facility 262 may beprovided, where a collaborative group of users may exchange questionsand answers, such as in a project, and where at least one user maymanage exchange through the question and answer management facility. Forinstance, users may be buyers and sellers in a transaction, where buyersask questions and sellers answer questions. In another instance, usersmay be customers and expert representatives of a product, service, deal,and the like, where customers are asking questions and the expertrepresentatives are answering questions. Through the question and answermanagement facility, the at least one user may then manage the exchange(such as being identified as a question and answer coordinator).Alternately, each user in the exchange may use the question and answermanagement facility to manage the exchange, thus creating a dynamiccollaborative question and answer environment. Management functions andfeatures of the question and answer management facility may include theability to trace questions and answer exchanges, archive the history ofa question and answer exchange and resolution, provide the facility toimport bulk questions into the exchange, remove a question from theexchange once the question is answered, match questions for answering toan individual or group of individuals based on a criteria or metadataextracted from the question, and the like. A question and answerexchange may be provided a question status, a delegation status, andurgency indicator, and the like, and marked as proposed, new,in-process, closed, FAQ, and the like. Questions and answers may besorted, searched, organized, and the like based on a criterion, such asby submission date, status, category, a question ID, keyword, priority,and the like. A user or coordinator may assign a question one or morecriteria, such as a level of priority (e.g. high, medium, low), whichmay aid experts to focus their attention on issues that are mostimportant.

In an example, suppose a group of individuals is engaged in anacquisition transaction, where there are buyers and sellers, where thereare a number of buyers and sellers on each side of the potentialtransaction, and where the buyers and sellers have different roles andexpertise relative to the acquisition. A buyer may ask a question to thesellers. Through the question and answer management facility thequestion may be presented to the sellers, where one seller addresses thequestion, and after an exchange, the question is resolved. The questionand answer management facility may track the exchange, archive theexchange, remove the question from further discussion, remove thequestion from a pending question queue as provided to buyers and orsellers (such as though a dashboard interface), and the like. Further,the question may be matched to a particular buyer and or seller foranswering and resolution, such as based on a user expertise criteriaassociated with the user (e.g. the user is identified as being ‘legal’,‘finance’, ‘technical’, and the like. The matching may also bedetermined through a facility of the question and answer managementfacility that uses characteristics or metadata associated with thequestion to match the question to an individual best suited to answerthe question. For instance, the question may contain a word, string,phrase, and the like, that matches a criteria of being a financialquestion, and so the question is then directed to users on the otherside of the exchange that represent finance. In embodiments, once thequestion and answer exchange is resolved, the question and answermanagement facility may mark the question as resolved, remove thequestion from the exchange, archive the exchange, and the like.

In embodiments, a user may import bulk questions and/or answers into theexchange through the question and answer management facility. Forinstance, a buyer and/or seller in an exchange may have a set offrequently asked questions and/or answers that are relevant to theexchange, and import them into the exchange. In an example, a buyer mayhave a standard set of questions for a seller, such as where thestandard set of questions have been developed over time. To facilitatethis import, the question and answer management facility may accept thebulk import in a plurality of formats and from a plurality of computerapplications (e.g. imported to the system from a Microsoft Excelworkbook).

In embodiments, the entrance of a user into an exchange may be as anauthenticated access, an un-authenticated access, a semi-authenticatedaccess, and the like, as described herein. For instance, management ofan exchange may require the user be authenticated as having theprivileges to manage the exchange, to view the exchange, and the like,but an unauthorized user may be able to insert a question into theexchange, and receive an answer from within the exchange group, but nothave access to content within the exchange that requires authentication.In embodiments, a question and/or answer from an un-authenticated usermay show an indication of such to other users in the exchange.

In embodiments, the question and/or answer in an exchange may includelinks to further information regarding the question and/or answer. Forinstance, the question may request data, and a link may be provided bythe user answering the question to direct the user to the location ofthe data.

In embodiments, the question and answer management facility may providethe ability to retract, correct, or redact questions and/or answers aspart of the exchange. For instance, an answer may be provided by a user,but later found to inaccurate. In this instance, the answer may beoptionally refracted or corrected. In embodiments, users in the exchangemay be informed when a retraction, correction, or redaction is executed.

In embodiments, the question and answer management facility may beprovided through a user dashboard interface to manage the question andanswer environment, such as to increase client usability, provideoperations (e.g. delegate, close, withdraw, answer, change priority, andthe like, in association with a question and answer exchange), providefor a facility for importing and exporting content associated with aquestion and answer exchange, manage priority (e.g. includingmanagement, voting, questioning, and the like, the priority of aquestion), provide filtering facilities for questions and answers,ability to re-open a closed question (e.g. for changing the answer, toreopen discussion, to solicit additional answers), alerts to questionsand/or answers being changed, the ability for a respondent to save adraft answer prior to posting, and the like.

In embodiments, there may be scenarios where a coordinator does not havesufficient visibility in a question and answer session, such as on theanswering question side. In this instance, a ‘special coordinator’ maybe assigned for a category. For example, a CFO of a selling companymight be acting as the coordinator on the selling side, delegating outto various subject-matter experts (SME), such as accounting, sales,contracts, and the like. On the other side, a buyer may want greater ormore focused visibility, such as an effective tax rate, and the like.Ordinarily a coordinator would have to use standard communicationschannels to manage this delegation, such as through emails. Now the CFOcan assign it to any of their groups through a ‘SME delegation’ or‘limited coordinator’ method. Thus, the question and answer exchange maybe improved, such as for a particular category.

In embodiments, a question and answer mobile facility may be providedfor mobile devices to provide a user with question and answer facilitycapabilities while away from their computer, such as when they haveaccess to a smart phone, tablet, and the like. This mobile facility mayprovide for voice recognition for input, text-to-speech for output, textrecognition such as with a scanner or the mobile device's integratedcamera, and the like. For example, a user may take a photo with theuser's camera, have it captured and placed in the right place within anexchange with permissions, and the like, where the photo is of text, anobject for discussion, and the like. In embodiments, a user may addcontent to an exchange with a mobile device, such as convertingsomething to a question inside a question and answer session (e.g.,convert from the email). For example, the user may start with aquestion, and be able to directly convert that into a question on thequestion and answer session of an exchange. Then take the thread andstart a work-stream.

Single Sign-On

In embodiments, a single sign-on facility 264 may be provided, whereusers or organizations utilizing the system may be provided a privatechannel access to an exchange, such as through a single sign-on to thesystem with protected access. A Channel may provide a way to implement aprivate slice on the system, such as though a portal that allows usersto view only those exchanges explicitly permissioned to the Channel. Forinstance, a Channel may be a list of allowable brands combined with anIdentity Provider (“IdP”). When a user is authenticated by that IdP,that user may be considered to be in the associated Channel and his/herview of permissioned ILP data may be restricted to that of the Channel.In this instance a Channel is, essentially, a virtual private instanceof the system. In customer deployments where the system user interfaceis hosted by a third-party, this system may better ensure that there isno data leakage between separately permissioned exchange domains.Private Channels may ensure that a client's information is only viewedby their SSO users. Private Channels may provide a means for ensuringthat users do not see information from other organizations while usingSSO, even if they are permissioned to other organizations' exchanges. Inan example, if a user is logged into the system using Company A's SSOconnection, they will see exchanges and data only for Company A, eventhough the user may have access to other organizations' exchangesthrough other access privilege. This facility may support organizationsthat want to authenticate external users through SSO. For instance, LifeSciences and Alternative Investments clients that maintain their ownportal may want to authenticate their user community to using SSO. Inanother instance, a Johns Hopkins doctor may be in drug trials with twodifferent pharmaceutical companies, and if the doctor accesses throughthe channel of the Company A's website, then they only see Company A'sinformation. This functionality is especially useful anywhere that aclient wants to have a private portal in a multi-tenant scenario.

In embodiments, the system may provide for context-based, automatic,on-demand provisioning. For instance, a client may create a web pagewhere a user could enter credentials. When they create an account (e.g.,new employee), the system may automatically provision an exchange forthem, where the employee logs in by their structure. The SSO may verifythat the person has permission, and automatically set up an account forthat user, where everyone from that organization would be treated assigned-in to the organization. That is, once logged in, the user may gothrough the channel and access information without logging in again,such as based on the context provided through the user, theorganization, and the like. In embodiments, the context may be providedthrough tagging the user to enable future sign-ins. For example, acompany may want to provide an outside law firm to access certain datain an exchange, and through contextual-based provisioning, the law firmmay be tagged to not only allow them to access again without logging in,but will be restricted to only the content the organization is providedthrough the private channel. Thus, a user's access to certaininformation is restricted to the context of where they sign-in.

Un-Authenticated Document Exchange

In embodiments, an un-authenticated document exchange facility 268 maybe provided, where exchange managers may be able to mark specificexchange participants who are permitted to skip the login process (e.g.skipping steps requiring the providing of their user name and password),when downloading documents, such as from alerts. For instance, when apermissioned user tries to access a document through a special documentURL in an email alert, the document will start to download, withoutasking the user for further authentication. The special document URL mayallow such access for each document for the specific exchange user for aperiod of time, such as a week, a month, and the like, from the momentthat the alert was sent. The system may identify the users to whom thealert was sent, where access reports may indicate that the particularuser has viewed the document, even though an authentication is notrequired. Each exchange participant that was marked to allow such accessmay have a visual indication in the user's list view, to make it clearthat they have a different type of access rights. This type of accessmay be specific to a given exchange, and may not necessarily betransferrable between exchanges. This functionality may be especiallyuseful for clients that are distributing content to individuals andorganizations that access services very infrequently, where theseindividuals constantly experience challenges logging in and using theservice through lack of regular use, and often experience forgetting thelogin and password. For instance, an investment client may only send outcontent quarterly, and have a desire to allow a subset of theirinvestors to gain access to their statements without authentication.Instead of sending these investors documents via email, the system couldallow the fund administrators to send statements via thisun-authenticated service, thus alleviating the need for the investors toremember a login and password. In embodiments, the user may be provideda link to access the content, where after optionally providing aconfirmation of who the user is (e.g. an email address), the documentcan be downloaded. The use of this system may allow for targeting usersto receive special document access (e.g. through alerts, email links,and the like) and tracking of their document access (e.g. for legal andsecurity review), and the like. Users who are not required to log in maybe identified by a special icon or identifier, such as when managersview a user list. Document access reports may also be updated wheneverthe link is activated (e.g., ‘clicked’), and the access attributed tothe user who was permissioned to use the document. Since access tocontent may be enabled and tracked through a URL link, the system maythen limit distribution by de-permissioning a URL (which makes that URLinactive). Since the user doesn't know the URL, they can't obtain accessif the URL is inactive.

The use of un-authenticated access to content may have manyapplications. For instance, an organization may want to provide publiclyavailable information, where the system of un-authenticated access givespublic users access to the document without ‘permissions’, but allowsthe organization providing the information with a means of tracking theaccess to the information. For example, an organization may want to makepublic a ‘teaser’, such as with respect to an investment opportunity.The organization now is able to track the access to the information.

In embodiments, the use of un-authenticated access may enable anorganization to send out access to information without pre-populating acontacts list with secure-access users. The organization may only needto have a list of email addresses to send the URL link to, without theneed for credentials from the user.

In embodiments, the system may utilize a semi-authentication process,such as requiring the user to provide a personal ID (PIN), such asdetermined by the user or the organization providing the URL link.

Metadata Synchronization Facility

In embodiments, a synchronization facility 270 may be provided formetadata-based content synchronization, where the system may be utilizedto provide synchronization and sharing of content, such as amongst thevarious computing devices of a single individual, a group ofindividuals, an enterprise, and the like, where synchronization may beselective, such as a user selecting what files to synchronize, whatcomputing devices to synchronize, which individuals may share throughsynchronizing, and the like. The user may also set up rules by whichsynchronization is selected, such as rules associated with location of acomputing device (e.g. not synchronizing when a computing device is noton a secure network, in a foreign country, and the like), a versionnumber of the document (e.g. only synchronizing the most recent revisionof a document), and the like, where the rule is based on metadataattached with the document. In embodiments, documents may be geo-tagged,and through that geo-tagging the synchronization process may determinewhether to sync. A user may not only be able to identify a certainfolder for synchronizing with a group of individuals, but also that onlythe latest version of a document should be synchronized. In this way, auser being added to the synchronization group would not have all the oldversions of a document synchronized. This capability may help the usermake decisions that can reduce workload during synchronization and freecycles for synchronizing more critical content. In embodiments,synchronization may be contextual. For example, a person may be added toa synchronization group based on information about the person you areadding and how that person relates to a topic, a group, an exchange, awork stream, and the like, where the system tries to classify people andlink them.

In embodiments, ‘many-to-many’ synchronization may be provided, such aswhen a select number of users/devices needs to be synchronized to aplurality of other users/devices, where the users/devices may be a groupof users/devices that are a part of a workgroup, work stream,application, email list, and the like. Many-to-many synchronization mayutilize rules to determine what content to synchronize, who to includein the synchronization, and the like, where the synchronization may notbe restricted to just multiple devices, but to multiple systems based onthe rules. For example, a user receives an email in Outlook. If the userhas already linked that email thread to a work stream, that email shouldautomatically go to the work stream. Or the user receives something in awork stream, and the rules trigger synchronization. In another instance,if the user deletes an email from Outlook, based on the rules, thedeletion may not be synchronized, such as because the user needs to keepthe email in the work stream. In this way, the user is able to do theirwork in email, but have the work stream synchronized correctly, based onthe established rules.

File Sharing Activity

In embodiments, a file sharing activity facility 272 may be provided topackage up and archive the history of file sharing between individualsin an exchange. The archived file sharing may be stored in a similarprocess as that of emails, and placed in an archive for future searching(e.g. for litigation or e-discovery requests). With the file sharingarchive stored in a similar format as that of emails, searching forsharing and searching for emails may be carried out together, where theemail and file searching archives appear to be, or actually are, asingle searchable archive. This archive may also be sharable with otherindividuals within the exchange, may be synchronized with other devicesactive with individuals in an exchange, and the like. The archiving ofsharing activity may be at an exchange-level, a user-level, adocument-level, and the like. For instance, a document-level archive mayinclude the document itself plus the whole history of the document (e.g.viewing history, who edited the document, when the document was signed,and the like), so that when this new archived history is found, such asin a search, a single document may be retrieved describing both itscontent and its history.

Collaboration Management Facility

In embodiments, a collaboration management facility 274 may be provided,where in the course of a collaborative exchange, users may haveexchanged documents and communications, shared content, synchronizeddevices, and the like, where the collaboration management facility maybe provided to manage the sharing of content and the retention, sharing,and persistence of shared content. For instance, a user may want toremove all trace of the exchange once the exchange is ended. The usermay want to control the amount of time a recipient may have or view adocument after delivery. The user may want to control the ability toprint, forward, view, the document on various platforms, on variousdevices, with certain individuals and/or organizations, and the like.The collaboration management facility may include a document retentionpolicy that determines the rules under which documents are retained. Forexample, documents may be tagged with a document retention tag thatdeletes the document in a set number of days, until a milestone event(e.g. such as tied to a Gantt chart), based on a criteria (e.g. when adocument is signed, after the document has been viewed), and the like.In an example, a document offering a service or product may be taggedsuch that if the recipient of the offering declines the offer, thedocument is deleted. Alternatively, the document offering may be througha link, and the link is disabled after the recipient declines the offer.The document may be tagged with a duration-based permissioning, suchthat the document will be deleted, or a link disabled, at the end of awindow of time has closed. The document may be tagged for temporaryviewing, such as only viewable for a short duration of time when thedocument is viewed on a mobile device. For example, a recipient may havedifferent viewing and retention permissions for the same documentdependent upon the device they are viewing the document on, where theymay have permission to view the document for a week on a computer, butonly for a few minutes on a mobile smart phone. Alternately, it may be alink to the document that has a limited time for activation. This formof non-persistent sharing may allow the user to share documents in atime-sensitive manner, without the concern that the document will beretained beyond the desired duration. For example, a banker maydistribute research to prospects. But the research is the property ofthe bank, and the banker needs to control access to the research. Oneoption may be for the banker to distribute the research through a URLlink, where the URL is tagged for access control through the retentionpolicy. In embodiments, the retention policy may also dictate retentionwithin a group distribution, providing different retention privileges todifferent recipients, and track the viewing actions and executeviewing-retention limitations for users within the distribution.

Geo-Tagging Facility

In embodiments, a geo-tagging facility 278 may be provided, where adocument may be geo-tagged such as to indicate where a document has beencreated, sent from, received, edited, viewed, and the like. Geo-tagginga document may include information that is appended to and travels withthe document through distribution, sharing, modification, and archiving.Geo-tagging information may include geographical location information(e.g. city, state, territory, country, region, zip code, latitude andlongitude), a business location (e.g. company name, company address,business unit), a network location (e.g. secure network, an enterprisenetwork, a public network, a wireless network), a storage location (e.g.archive location, thumb-dive storage, DVD), and the like. In an example,a document may be created by a user at Company ‘A’ in San Francisco,where the location information may include the company name and thecity, as well as other information such as time and date and user'sname. The document may then be distributed to two other users in twodifferent counties working with two different companies, where thisinformation may be appended to a geo-history of the document (e.g. asstored as metadata along with the document). Additional information maybe appended to the document as it is edited, redistributed, and finallyarchived. The geo-location information may be searched on, such asduring its life as an active document or while stored in archive.Geo-tagging of data may better enable the discovery of the document'shistory (and content therein), such as for legal or e-discoverysearches.

In embodiments, an input file optimization facility may be provided,where rules and/or intelligence on document actions increase efficiencywith which tasks, especially large tasks, are executed. For instance,when attempting to add a folder with a specific name, it may check andopen the folders tag, check if a folder tag is already open, and if thecurrent open folder is different to the new folder then close theexisting folder and open the new folder tag.

Archive Facility

In embodiments, an archive facility 280 may be provided, such as wherethere is a need for same-day/next-day delivery of archives, such as in aquick and efficient way to create HTML archives (snap shots) ofexchanges without leaving any footprint on the exchange. In embodiments,an API archive facility, created through API calls, may allow automationof the system that decreases delivery time as well as improving otherkey considerations for archives, including reliability, efficiency, timeto production, scalability, predictability, simplicity of process,support, market needs, audit compliance, security compliance, cost, andthe like. The tool also may have logic built in that allows thesplitting of a single exchange into multiple volumes and splitting at afolder level or documents level. As well as pulling down HTML archives,the tool may be modified from within the configuration file to onlydownload meta-data. Doing this may allow the tool to provide fullmeta-data reports similar to back-end database reports on folders anddocuments.

Features of the archive facility may include automated confirmationletter creation (e.g. such as including e-signature), configurableviewpoint and naming structure, (e.g. by user ID, email address,exchange group, composite group), automated exchange freeze to createnon-permissioned groups, archiving from frozen exchange to check auser's ‘pre-freeze’ role and impersonation against old (inactive)profile, freeze letter creation, and the like. FIG. 11 illustrates anexample archive process, including authentication and impersonation ofusers 1114, metadata collection 1108 (e.g., including reports, such aspermission reports, folder reports, document reports, viewpoint reports,and the like), download and data processing 1110, and creation ofarchive 1112.

The design of the archive facility may include a two-part routine thatwill firstly quickly and efficiently impersonate a user and download allthe documents and folders to which they have visibility. The second pathmay be to create a HTML file that is a representation of the exchangethat the end-user may navigate thorough to get to documents. Keyfunctionality of the archive facility may include downloading usercoverage for a selected user, ability to impersonate any user within anexchange if logged in with a role of manager or a hidden manager,minimal user interaction, automated download procedures (which mayhappen sequentially), ability to split archive volumes based on adefined size specified, process messaging relevant to a splittingprocess, support of UTF-8 encoding of document and folder names, debugmode for advanced logging and trouble shooting, audit files for trackingactivity (e.g., user successful logins, exchange ID of where to downloadfrom, downloaded files, warnings, system errors), ability to split alarge exchange over n number of volumes based on size of the volumes,splitting at a determined level (e.g. document level, folder lever),downloading of questions and attached documents, ability to freeze anexchange into several states (e.g. cold freeze (the phase of theexchange is placed into hold, and all users that are not reviewers arechanged to reviewers), partial freeze (the phase of the exchange isplaced into preparation, and all users that are not previewers orreviewers are changed to previewers), warm freeze (the phase of theexchange is placed into Open, and then all users that are not previewersor reviewers are changed to previewers)), ability to un-freeze anexchange and revert it back to a previous state (e.g. in regard toexchange phase and user role), and the like.

The functional structure of the archive facility may include a model, aview, a controller, and the like. For instance, the role of the modelmay be to make calls to the controllers, which are the classes that holdall the controllers. The model may also provide a specific response thatis parsed into the model object, which may keep the ‘controller layer’response away from the view and ‘controller local’. Within the view theuser may be able to enter their login credentials (this may also bewhere files (e.g. excel files) are created and read in. There may be astatus display that is updated with events. It also may be in the viewthat the user is able to see if the process has completed with anyerrors. There may be multiple controllers, such as one for handlinglocal events and a second within the combined layer that creates a webrequest. The local application may take user inputs and handle buttonevents, call the models within a combined layer, contain the businesslogic to process the response from the combined layer model, and thelike. The combined layer may be able to execute commands, and when aresponse is given, it may be parsed into the models response objects.

The archive process may be designed to be run by a trained individual asopposed to a user in an exchange. The process may use a combination ofpublic and private API calls. Actions relating to this tool may includelogin-logout, getting folders, getting documents, downloading documents,downloading Q&A attachments, get all categories, get all questions usingsmart folders, get all workspace settings, update workspace phase, getuser coverage report, create group, get group, get all workspace groupsand details, get all workspace users and details, add existing user togroup, and the like.

Secure Collaborative Content, Fair Share Queuing, Location Based FileAccess, Multi-Factor Authorization, Configurable Password, ClientArchiving, Client Key Hosting Facilities

In embodiments, a secure collaborative content facility 282 may beprovided for the secure management of a plurality of secure documents,resources, communications, workflows, and the like, among a plurality ofusers, where secure documents, communications, and the like may containor have associated therewith metadata content. In embodiments, a one ormore workflows may be created, triggered, modified, or redirected basedon the metadata. The workflows may include, without limitation,workflows that include steps that take place across multiple entities orenterprises, such as work flows involve in inter-enterprise negotiation,collaboration, or cooperation. Secure communications may include anemail, FTP, USB transfer, a secure third-party document sharingfacility, and the like. The secure management may be for an informationtechnology environment that is inside or outside an enterprise firewall,for secure or public use, through consumer grade or enterprise grade,and the like. The trigger may be metadata content in association with asignature, request for information, request for collaboration,communication with a new contact, and the like. For example, anenterprise user, working inside the enterprise firewall, may receive anew contact from a prospective client, where metadata in or associatedwith the communication triggers a new workflow for a new project. Inanother example, a manager may provide a new project document to anassociate, where the new project document includes metadata thattriggers the generation of a new workflow. In this way, the securecollaborative content facility enables a more seamless process forgenerating or managing workflows from metadata content in an initiatingexchange. Metadata may be stored, for example, as part of a document,file of the like, such as in one or more tags, fields or headers. A hostsystem of the type described throughout this disclosure, in connectionwith creation and handling of secure information exchanges, may definemetadata types and associate the metadata types with one or moreactions, including actions that may be linked to workflows. Such asystem may indicate locations for storing and retrieving metadata, aswell as rules pursuant to which metadata may be processed in connectionwith workflows. A metadata definition might correspond to any of a rangeof states, features, attributes, events, activities, or actions that aretypically stored or used in connection with an exchange, such as userattributes (e.g., linkage of users to enterprise, work group, or thelike), enterprise attributes (department information, and the like),security attributes (policies, access rules), storage attributes, andthe like. Thus, a metadata definition may indicate how a user may, viametadata stored in a file or other resource or stored in a separatelocation but linked to the file or other resource, ensure the handlingof the same by the system. For example, a metadata definition may allowa resource to be designated as a particular type of resource withrespect to which, upon creation (and inclusion of the metadatadefinition), a work flow is automatically initiated that sends thedocument to a defined type of user within the entity for review andcomment, notifies another user of creation, notifies another user of arequirement to create another resource, notifies another user to hold intaking action, or the like. Thus, a single definition may set out orinvoke stored rules by which a series of different actions, or even setof multiple work flows may be initiated, modified, or stopped.

In embodiments, a fair share queuing facility 284 may be provided, forthe execution of processes described herein, exchanges, sharing,collaboration, and the like, when jobs are required to be queued forprocessing through the system. Traditionally, queuing is on a first comefirst serve basis, but with large jobs such as with some processesdescribed herein, this may lower performance of the exchanges that arehosted. For example, suppose a client 1 posts a job with 20,000 tasksinto a queue. On a first come first serve basis, the system would haveto process all 20,000 tasks of this job before beginning the processingof a second job. This may be adequate if all jobs are large, but if asmall job is queued behind the large one, undue degradation of systemperformance may result as related to a project for which the small jobis associated. However, queuing may be adjusted so as to queue jobs inan equitable manner through a dynamic share queuing facility, allowingmultiple clients to submit bulk requests to the same work queue to beprocessed in parallel. On such jobs only the first n messages out of Nmay be created, and after that, a bulk message containing (N-n) messagesis added at the end. Once n first messages are processed only thenanother n tasks get processed, and another bulk message at the end with(N-n-n) tasks. In this example the system may take 5 tasks out of 20000tasks and put them in a queue as separate messages and add a bulkmessage with 19995 tasks in it (20000-5). Once the first 5 tasks areprocessed and the bulk message is picked up from the queue may theprocessor take another 5 tasks and put them back in a queue and add abulk message of 19990 tasks at the end of the queue. In this instance,if Client 2 comes in with a task, it will have to wait no more than thetime to complete 5 tasks. If Client 2 comes in with 20000 tasks, tasksof Client 1 and Client 2 may be interspersed. This solution may workwith multiple processors on the queue as well. Processing of bulkmessages may be used to reorder execution (priorities) of tasks so everytime bulk messages get processed the system may specify a rule as to howto determine what next n tasks should be converted into messages to beprocessed.

In embodiments, a dynamic share queuing facility may be provided, wheremultiple clients are able to submit bulk requests to the same work queueto be processed in parallel, such as with the following steps: (a)receiving a large job of N tasks, wherein the job is categorized as alarge job when N is greater than n predetermined maximum number of taskspermitted to be queued for processing in a single job; (b) queuing thefirst n tasks out of the N tasks in the large job, wherein the remainingN-n tasks of the large job are stored in a holding queue; (c) queuing asubsequent job based on the following criteria: (i) if no subsequent jobis received, queue the next n tasks of the large job as taken from theholding queue, (ii) if a subsequent job is received where the number oftasks in the second job is equal to or less than n, categorize thesubsequent job as a small job and queue all the tasks in the subsequentjob, (iii) if a subsequent job is received that is a second large job,queue the first n tasks out of the N tasks in the second large job,wherein the remaining N-n tasks of the second large job are stored in asecond holding queue; and (d) continuing the steps in (c) for additionalsubsequent queuing, wherein queuing of jobs for processing alternatesbetween new jobs being received and jobs having remaining tasks storedin holding queues.

In embodiments, a location-based security facility 290 may be providedfor file (or other resource) access within a cloud-based or server-basedfile storage facility where permissions of the file determine accessbased on location, such as the location of the device requesting thefile or resource. Enterprises often want to limit access to sensitivedata based on whether someone is physically present at a facility orlocation. In the past this has been achieved using physical security,meaning the individual who needs access was required to be co-locatedwithin the same premises as the entity that provides access. There havebeen no solutions to the problem other than physical security or networkbased security (e.g. based on a person's Internet Protocol address) andrestricting access to data using a networked personal computer or mobiledevice. Virtual Private Networks have helped in this regard but they arestill very restrictive when allowing access to individuals who do notbelong to the same company as the source of the file or data. With theproliferation of devices that can determine the geographical location ofa person using the device, this job becomes much easier. Thelocation-based security facility applies geographical location basedsecurity to files accessed from a cloud or server based storage orservice. In this system, files may have attributes of geographicallocation, and rights to view the file or save portions thereof mayrequire the file to be accessed from a device where the location of thedevice can be determined and determined to be within range of ageographic location, such as specified on or in relation to the file.Files may be stored in a cloud based or server based system from wherethey can be retrieved by a person who has rights to the said file.Within this system, file attributes may be defined, where theseattributes may be part of the metadata associated with the file, andtherefore searchable. To these existing attributes, spatial data(location where the file can be accessed from) may be added. Thelocation may include geographical coordinates (latitude and longitude),a country, a region, a city, an enterprise location, and the like. Thesystem may provide a way for an individual to add a file to the servicewith a desired location where the file can be accessed. The system mayalso provide a way for the individual to add a radius from theaforementioned location to the file attributes. Based on these twoinputs (location and radius), the file attributes may now be updated.Once the file attributes are set, they may be searchable and indexed viaa geographical positioning data store. When an individual who has accessto the file (e.g. based on permissions in the service) tries to accessthe file from a device (e.g. any mobile computing device or a personalcomputer), the service determines the location of the device. If thereis no mechanism to obtain the location, then the file access is notallowed. If there is a mechanism to obtain the location, then theservice compares the location to the location information associatedwith the file on the service. Once the comparison is done, thedetermination of whether the file is accessible or not may be providedby the service using the stored location and radius attributes. If theindividual can access the file, then the right level of access isprovided (e.g. read, write, save, print). If not, the file is notprovided. Multiple locations and radii may be defined per file, such asseveral addresses and radii from those addresses where the file can beaccessed.

In embodiments, a multi-factor authentication facility 201 may beprovided when access to the system includes multi-factor authentication,such as at login. Multi-factor authentication may set authenticationrequirements beyond username and password, to not only challengequestions, but to risk-based questioning and detection based on a useror device history, such as location, device type, pattern of use, andthe like. This method may be used at login, when moving betweenexchanges within the system, on a per-exchange basis, and the like,where preferences and/or settings may set whether multi-factorauthentication is used, and to what level of complexity. For example,some work environments may require a mid-risk level of complexityrequired for login, while others may require a greater complexity foraccess. The system may require a level of complexity that looks at aplurality of channels, such as different devices, mobility vs. desktopuse, and the like.

In embodiments, a configurable password facility 203 may be provided forconfigurable passwords. For instance, at the exchange level or thecustomer level a user may be able to determine what a password policywould be, such as when it will expire, what complexity is required, andthe like. A user may login and use their most stringent policy based onall the exchanges for which the user is a member. For example, in oneexchange a user might need a very secure password, while others it wouldnot, so the user may use a password that is compliant to the morestringent of the two. The user may be able to use the greatest commondenominator in password usage across multiple exchanges, such as at thecustomer level, at an individual exchange level, and the like.

In embodiments, a client archiving facility 205 may be provided forarchiving of content made to an internal archive storage facility withinthe system, to at least one of plurality of customer server(s), to athird-party storage center, and the like. In the instance where contentis being stored on a customer server or to a third-party storage center,the system may have the capability to pull back data in part or intotal, such as in a similar manner as that of a document sent to anindividual may be pulled back. For instance, in the case of amulti-partner collaboration, where multiple partners have elected tostore data in their system as archive, one partner may decide to dropout of the collaboration, and the system may then pull back all the datapreviously archived on the partner's server. In another instance,customers may want to take over an archive, such as when an exchange isgoing to be closed, where the content may be written from the system tothe customer's server. In this instance, the system may relinquishaccess to the content. In another instance, there may be a hybridarchiving structure set up, such as having a different archivingconfiguration on a per unit, per organization, and the like, basis. Theability for a customer to archive content to their own servers may beenabled through an application, API, and the like. When archiving istransferred between entities, such as when an archiving configuration ischanged, a chain of custody, a history of ownership, and the like may bemaintained. Configurations may also be able to set a level ofgranularity for the archived content, such as to a lower level ofgranularity when the content is in a dormant cold storage, but in ahigher level of granularity when the content is being actively accessed,such as when an exchange is active.

In embodiments, a client key hosting facility 207 may be provided toenable users to host their own keys in association with access tocontent. For instance, a client may want some form of extra protection,such as ability immediately close off access to content (a ‘red button’or ‘kill switch’ of sorts) so secure content will be shredded. Toimplement this, the system may encrypt content with a key over which theclient has control. The client may host the key, such as creating anapplication/web application that they host and completely control, wherethis application can expose the key back to the system for theapplication. The client can then pull out the application, so the systemdoes not have the keys, eliminating access to the content. There may bea plurality of different options for handling the keys, such as thesystem having an application that the system provides to a client thatdeploys to a semi-public cloud, that the client hosts on their own, thatthe system host it for the client, have a ‘red button’ or ‘kill switch’in the system's own application (e.g. the system holds the keys, but thekeys are shred when the client ‘hits the button’), the client has amaster key for their exchange, the client is able to download the keyand get the material back but otherwise can ‘shred’ the content, and thelike.

Offline File Access

Referring to FIG. 12, in embodiments an offline file access facility 288may provide offline file access to remotely stored files, such asprotected by information rights management via an encrypted key lease(e.g., where a single key enables a single file access). Secure offlinefile access is a significant business problem. In the past, providingoffline access to files increased the risk of data loss or theft ofintellectual property that could prove disastrous to a company. However,providing convenient offline accessing of protected or secure files isalso very important, as individuals accessing files are not alwaysconnected to a network that allows them to do further work on the fileswhile offline. Existing solutions are very limited, such as onlyallowing for a date-based file access, where the date is set on the fileor on a server. Existing solutions also do not provide for encrypted keystores, such as protected by a personal password, identification number,and the like.

In embodiments, files may be stored through the offline file accessfacility 288 in a cloud-based or server-based system from where they canbe retrieved by a user who has rights to the file. Within this system,files may be protected by an information rights management mechanism.Retrieval of these files may be based on any of a plurality of publickey exchange mechanisms available in the art (e.g., Diffie-Hellman). Toview files, generated keys are sent from the file access facility 288 tothe user wishing to view these files on a computing device. When a userwho has access to the file (e.g., based on permissions in the fileaccess facility) tries to access the file from a computing device (e.g.any mobile computing device or a personal computer), the offline fileaccess facility 288 determines whether offline access is allowed forsuch a file. If offline access is allowed (e.g., access to the file on auser computer device while the computer device is not connected to thenetwork), one or more generated keys may be sent to the computing devicefor future use, such as one key for each access. The number of times thefiles can be accessed at a later time without network connection, suchas determined by the number of keys provided, may be set at the offlinefile access facility 288. This number may also be used in conjunctionwith an expiration date on the keys (e.g., which may also be set at thefile access facility) to provide further constrained access to the file.Keys for file access may be handed out to the computing device when itis online to a user that has been authenticated and with permissions todownload the encrypted file for offline access. Keys may be stored in anencrypted storage and a Personal Identification Number or a passwordselected, such as by the owner of the device, to protect the encryptedstorage.

In a non-limiting example, and continuing to refer to FIG. 12, a usermay be online with a mobile computing device 1210 and make a request todownload an encrypted file 1206 from a secure database 1204 associatedwith the offline file access facility 288. The user may provide apassword to the offline file access facility 288 in order to gain accessto the file, which may then be authenticated by the offline file accessfacility. Once authenticated, permissions may be checked to determine ifthe user has permission to download the encrypted file for offlineaccess. If so, then the offline file access may download the encryptedfile 1206 along with at least one of a plurality of encryption keys1208. Now, when the user moves offline from the network, the user isable access the encrypted file 1206 by using an encryption key that isstored on the mobile computing device 1210 along with the encryptedfile. When the user moves back online with the network, the offline fileaccess facility 288 may continue to synchronize keys and files, such asstored in the secure database 1204 and on the mobile computing device1210, as based on the usage of encryption keys 1208 and access to theencrypted file 1206 by the user while the mobile computing device 1210was offline.

Additionally, to access the encrypted file the user may need to providea password to access the encrypted file to prevent unauthorized usersfrom accessing the encrypted file with the encryption key. In theinstance when one key provides a single access, if the user wasdownloaded multiple encryption keys, they may be able to access the filemultiple times. Alternately, a single encryption key may provide formultiple accesses, such as determined by the offline file accessfacility at the time the encryption keys 1208 were downloaded to themobile computing device.

In embodiments, a method may be provided for secure offline computercontent access, comprising at a server-based file access facilityconnected to a network and to a secure database, storing a data file asan encrypted data file along with a plurality of encryption keys in thesecure database, each of the plurality of encryption keys providingaccess to the encrypted data file, the encrypted data file accessible asdownloaded to a mobile computing device that is not connected to thenetwork only through use of at least one of the plurality of encryptionkeys and presentation of a user secure identifier from a user of themobile computing device, wherein the at least one of the plurality ofencryption keys allows the user of the mobile computing device to accessthe encrypted data file a limited number of times; receiving, at thefile access facility, a request from the user of a mobile computingdevice for offline access to the data file when the mobile computingdevice is disconnected from the network, the access request using theuser secure identifier; authenticating, at the file access facility, theuser's permission for offline access to the data file while the mobilecomputing device is disconnected from the network; and downloading, uponauthentication, to the mobile computing device, the encrypted data filealong with the at least one of the plurality of encryption keys whilethe mobile computing device is connected to the file access facilitythrough the network. In embodiments, the encrypted data file stored onthe mobile computing device may be assessed through the use of the atleast one encryption key and the presentation of the user secureidentifier by the user on the mobile computing device while the mobilecomputing device is disconnected from the network. The encrypted datafile may be access-controlled through digital rights management. Thefile access facility may be connected to the secure database across thenetwork. The secure database may be a cloud-computing storage facility.The mobile computing device may be a laptop computer, a tablet computingdevice, a mobile phone enabled computing device, and the like. Thesecure identifier may be a password. Authenticating may be performed byutilizing the user secure identifier to check the user's permissionprofile for permission to access the data file offline. The permissionprofile may identify a number of offline accesses the user is permittedwhile disconnected from the network. The file access facility, uponauthentication and identifying the number of offline accesses the usermay be permitted when disconnected from the network, to download theencrypted file to the mobile computing facility along with at least oneof a number of encryption keys equal to the number of accesses the useris permitted while disconnected from the network and an encryption keythat can be used the number of times. A number N encryption keys may bedownloaded to the mobile computing device, such as where one of thenumber N encryption keys enables one access to the encrypted data file,and after the one access, the one of the number N encryption keys cannotbe used for a subsequent access to the encrypted data file. The limitednumber of times the user is allowed to access the encrypted data filewith the at least one of the plurality of encryption keys may be limitedto one time. The plurality of encryption keys may be only valid for acertain time period.

Spreadsheet Viewer

In embodiments, a server-based spreadsheet viewer facility 292 forrendering a spreadsheet document to a client computing device may beprovided that enables the client computing device to view a spreadsheetdocument without the use of the spreadsheet's source application (e.g.,Microsoft Excel). Rather than opening the spreadsheet document directlywith the spreadsheet application, a client spreadsheet viewer on theclient computing device may enable a user to view and interact with a‘viewable spreadsheet document’ that has been rendered by theserver-based spreadsheet viewer facility, where the original spreadsheetdocument is stored with the server-based spreadsheet viewer facility,such as transmitted to the spreadsheet viewer facility by a first usertrying to share the spreadsheet document with a second user, by thesecond user who has been sent the spreadsheet document by the firstuser, and the like.

In a non-limiting example, and referring to FIG. 13, the user of a firstclient computing device 1308 may send the spreadsheet document to theserver 1304 (e.g., a secure server) hosting the spreadsheet viewerfacility 292, along with a sharing invitation to the user of a secondclient computing device 1310 with permission to view the spreadsheetdocument. The second client computer 1310 may, upon the user's request,communicate with the spreadsheet viewer facility 292 to render thespreadsheet document with a spreadsheet renderer 1306 to a clientspreadsheet viewer 1312 on the second client computer 1310. Thespreadsheet renderer 1306 may then transmit spreadsheet document data tothe client spreadsheet viewer 1312 for the initial rendering of therendered spreadsheet document. The user of the second client computer1310 may then interact with the rendered spreadsheet document, where theclient spreadsheet viewer 1312 transmits user actions (e.g., keyboardand mouse actions) to the spreadsheet viewer facility 292 forinterpretation and updating of the rendered spreadsheet.

In this way the rendering is an active rendering of the spreadsheetdocument, where the spreadsheet renderer 1306 keeps updating therendered spreadsheet document as presented to the user of the secondclient computing device 1310 through the client spreadsheet viewer 1312.In embodiments, the spreadsheet viewer facility 292 may utilize aspreadsheet application 1302, such as located on the server 1304 orinterfaced with remotely, such as a software-as-a-service type remoteinterface. The spreadsheet viewer facility 292 may then utilize thespreadsheet application 1302, the spreadsheet document, and thetransmitted user actions to generate the rendered spreadsheet documentdata for transmission to the second client computing device 1310. Theclient spreadsheet viewer may then transform the spreadsheet data to aviewable spreadsheet format, and provide viewing capabilities to theviewable spreadsheet document on the second client computing device1310, where viewing may include viewing spreadsheet cells, associatedcell formulas, and the like, and where the user may be able to alsoextract data as well as view the data.

In embodiments, the client spreadsheet viewer 1312 may enable the userto take photos or screen-shots of the viewed document, such as part ofan audit trail, signature verification, and the like. Because the clientspreadsheet viewer 1312 is able to view content without the actualapplication present, the client spreadsheet viewer 1312 may be able toprovide these functions without a license to the spreadsheet applicationuse. In embodiments, the client spreadsheet viewer 1312 may beimplemented through a browser interface on the second client computingdevice 1310. In such embodiments, server-side processing and executionmay run the application, taking mouse clicks, touches, keyboard inputsand the like from the client computing device interface, performingfunctions, and rendering views back to the client spreadsheet viewer1312. Thus, a user of the second client computing device 1310 may seecalculations, view formulas (such as by mousing over a cell), andmanipulate data, but the execution of such interaction takes place on aversion of the spreadsheet application 1302 that is associated with theserver 1304, such as behind a firewall in a secure data location. Amongother things, this capability allows users to temporarily accessspreadsheet content, while assuring the security of such content,including making it more convenient to revoke access to content withoutleaving versions of an important spreadsheet.

Referring to FIG. 13A, in embodiments the first client computing device1308 may send the original spreadsheet document directly to the secondclient computing device 1302. In this instance, the second clientcomputing device 1310 may transmit the spreadsheet document to thespreadsheet viewer facility 292 for rendering as described herein.

In embodiments, a method for rending a spreadsheet document may beprovided, comprising providing, on a server-based computing device, aspreadsheet viewer facility configured to render a spreadsheet documentcreated by a spreadsheet application as an actively rendered spreadsheetdocument in a client spreadsheet viewer running on a client computingdevice without the use of the spreadsheet application running on theclient computing device; rendering the spreadsheet document as anactively rendered spreadsheet document from the spreadsheet viewerfacility to the client spreadsheet viewer; transmitting at least onekeyboard and mouse action on the client computing device to thespreadsheet viewer facility, wherein the at least one keyboard and mouseaction is associated with a selection of a cell in the actively renderedspreadsheet document subsequent to the rendering of the spreadsheetdocument; and transmitting a spreadsheet data content for the selectionof the cell of the actively rendered spreadsheet document from thespreadsheet viewer facility to the client spreadsheet viewer. Inembodiments, the spreadsheet document may be received at the clientcomputing device from a second client computing device, where the secondclient computing device sends the spreadsheet document to thespreadsheet viewer facility for rendering. The spreadsheet document maybe received at the server-based computing device for rendering to theclient-computing device. The spreadsheet document may be disabled frombeing opened by the spreadsheet application running on the computingdevice. The spreadsheet viewer facility may provide permission foraccess to the spreadsheet document as an actively rendered spreadsheetdocument. The spreadsheet document may be disabled from being opened bythe spreadsheet application of a software-as-a-service application. Thespreadsheet viewer facility may provide permission for access to thespreadsheet document as an actively rendered spreadsheet document. Thespreadsheet application may be run directly on the server-basedcomputing device, run remotely as a software-as-a-service from a remotenetworked location, and the like. The spreadsheet data content may benumeric data from the cell, text data from the cell, a formulaassociated with the cell, and the like. The rendering of the spreadsheetdocument may transform a plurality of spreadsheet data comprising withthe spreadsheet document into the actively rendered spreadsheetdocument. The transformation may be on a cell-by-cell basis anddependencies among cells are maintained in the transformation. Theclient spreadsheet viewer may be adapted to provide permission to copythe spreadsheet data content. The client spreadsheet viewer may beadapted to provide manipulation of the spreadsheet data content in thecell. The client spreadsheet viewer may be adapted to provide permissionto take screen-shots of the actively rendered spreadsheet document. Theclient spreadsheet viewer may run through a browser running on theclient computer device.

Virtual Machine/Container Digital Rights Management

In embodiments, a virtual container digital rights management (DRM)facility 209 may be provided that utilizes a virtual containerenvironment (e.g., virtual machine, drive ‘x’ partitioning) to provideDRM control over content, such as to provide a facility for editing, butstill blocking the ability to print, save, print screen, and the like.Special plug-ins to an application may be used for such purposes, butalthough this configuration may still enable a user to read the content,they may not be able to make updates, or send it back to the originator.However, through the use of a virtual container environment, a proxy tothe application system may be created that would mount an encryptedfile, such as a protected ‘drive X’ item, enabling the control and/orprevention of operating system calls (e.g., in the Windows O/S the Win32calls to save files, access the network, and print screen), but allowapplications to work with the content. For instance, while the file isprotected as a drive X item, the application may work with the contentwhile protecting the document. Formatting, updating documents, and thelike may thus be allowed, enabling the system to save it back, encryptit, and the like, enabling the document to be sent to the creator of theprotected package, allowing someone to edit a file, even when they can'tcopy, print, and the like.

In this way, the virtual container environment may control furtherdissemination of the document that a user is sharing by blocking thevarious operating system commands (e.g., print, print screen, save,send, and the like) that are the normal mechanisms by which a recipientof a sensitive document would save or disseminate a copy, even thoughthe recipient may only supposed to have temporary, limited access. Aplug-in to an application that is being used to interact with thecontent can accomplish blocking the operating system calls, but may doso mainly by creating ‘read only’ versions. Often, the original senderof the document wants feedback from the user, such as edits orannotations, which could be embodied in the document if the user wereable to edit. The virtual container may be used to create a virtualdrive, encrypted version of the content (e.g., document). The virtualcontainer may allow applications (e.g., office applications and editingapplications) to edit the content, annotate the content, and the like,but where it can only be saved back to an encrypted form on the virtualcontainer, so that when a virtual container permission expires, only theoriginal sender has access to the edited version.

Referring to FIG. 15, a non-limiting example functional flow diagramdepicts an embodiment process flow for a document 1504 being editedthrough the protective virtual container DRM facility 209. In thisinstance, a first user 1502 utilizes the virtual container DRM facility209 to permit a second user 1506 to edit a protected document 1522version of the document 1504 while protecting the document 1504 fromsaving, copying, printing, print screen, and the like functions asapplied to the protected document 1522. As depicted in this instance, ina first step 1508 the first user 1502 may save the document 1504 as aprotected document 1522, where the document is protected by beingconfigured as or as part of a drive X 1220 storage location. The drive x1220 may have drive x protections 1518, such as disallowing commandsfrom an operating system 1526 from the second user 1506 saving theprotected document to a location other than the drive X 1220, copyingthe protected document, printing the protected document, print screeningwhile the protected document is being accessed, and the like. In asecond step 1510, permission may be set for the second user to edit theprotected document 1522, such as for a period of time (e.g., one day, aweek). Alternately, permissions may be restricted to a number ofaccesses the second user 1506 is permitted, such as limited to oneaccess, three accesses, and like, where the second user 1506 then hasthat many accesses to edit the protected document 1522, such asrepresenting the number of editing cycles the first and second usershave in editing the protected document 1522. In a third step 1512, thesecond user 1506 may edit the protected document 1522 to create anedited protected document 1524, where the second user is restricted fromanything but editing the protected document 1522 by way of the drive Xprotections 1518. In a forth step 1514, the first user 1502 may view andoptionally save the edited document 1524, where the first user 1502 maymaintain all of the functions of saving, copying, printing, printscreen, and the like, that the second user is blocked through the driveX protections 1518. In a fifth step 1516, the first user 1502 may removepermission for the second user 1506 to access the protected document1522 or edited protected document 1524, thus eliminating all access toany version of the document 1504 that the second user may have beenpreviously granted.

In embodiments, a method for securely sharing documents among userswithin separate business entities may comprise providing a virtualcontainer control facility, on a computing device with an operatingsystem, and at least one virtual container where commands from theoperating system for saving, copying, and printing of computer files arerestricted for users other than unrestricted users; storing by a firstunrestricted user of a first business entity a computer file in thevirtual container; granting access permission by the first unrestricteduser to view and edit the computer file by a restricted user of a secondbusiness entity; and receiving editing of the computer file by therestricted user, the editing creating an edited computer file within thevirtual container that is accessible by the unrestricted user. Inembodiments, the first unrestricted user may save, copy, print, printscreen, and the like, the edited computer file by the first unrestricteduser, including any portion of the edited computer file. Accesspermission may be removed for the first unrestricted user to thecomputer file and the edited computer file. The data file may beencrypted with digital rights management protection. The virtualcontainer may be a file location within a virtual machine configured torestrict the commands from the operating system. The virtual containermay be a file location within a computer drive configured to restrictthe commands from the operating system. Editing the computer file may bethrough a source application for the computer file, where the sourceapplication is permitted to edit the computer file. The granted accesspermission may be for a limited time period. The granted accesspermission may be for a limited number of accesses to the data file. Thegranted access permission may be based on a role of the restricted userwithin a transaction process involving the first and second businessentities.

In embodiments, a method for securely sharing documents among users maycomprise providing a virtual container control facility, on a computingdevice with an operating system, and at least one virtual containerwhere commands from the operating system for saving, copying, andprinting of computer files are restricted for users other thanunrestricted users; storing by a first unrestricted user a computer filein the virtual container; granting access permission by the firstunrestricted user to view and edit the computer file by a restricteduser; and receiving editing of the computer file by the restricted user,the editing creating an edited computer file within the virtualcontainer that is accessible by the unrestricted user. In embodiments,the first unrestricted user may save, copy, print, print screen, and thelike, the edited computer file by the first unrestricted user, includingany portion of the edited computer file. Access permission may beremoved for the first unrestricted user to the computer file and theedited computer file. The data file may be encrypted with digital rightsmanagement protection. The virtual container may be a file locationwithin a virtual machine configured to restrict the commands from theoperating system. The virtual container may be a file location within acomputer drive configured to restrict the commands from the operatingsystem. Editing the computer file may be through a source applicationfor the computer file, where the source application is permitted to editthe computer file. The granted access permission may be for a limitedtime period. The granted access permission may be for a limited numberof accesses to the data file. The granted access permission may be basedon a role of the restricted user within a transaction process.

In embodiments, the offline file access facility 288, the spreadsheetviewer facility 292, and the virtual container DRM facility 209 may becombined to provide a comprehensive method for secure viewing or editingof a document, such as a spreadsheet, where the spreadsheet viewerfacility 292 provides secure viewing, and in some embodiments editing,of a document when a client computing device is online, and the offlinefile access facility 288 and virtual container DRM facility 209 providesecure viewing, and in some embodiments editing, of the document whenthe client computing device is offline. For example, in order to providesecure access to a document, the display of the document may be renderedfrom a secure server to the client computing device rather thandownloading the document to the client computing device. Remote screenrendering may be enabled by protocols known to those of ordinary skillin the art, such as the remote desktop protocol of the Windows®operating system, similar protocols in Linux operating systems, orvarious server- or software-as-a-service-based protocols for suchrendering. Such protocols may allow not only viewing, but editing of thedocument from the client computing device, without having the documentitself reside on the client computing device. In this way, access to theunderlying document and its file, apart from the view currently beingdisplayed (e.g., a particular page or screen view of the document), iscontrolled by the secure server. In embodiments, the spreadsheet viewerfacility 292 may be used to render a plurality of different types ofdocuments (e.g., spreadsheets, word processor documents, presentationdocuments) to a document viewer on the client computing device, such asin conjunction with a web browser on the client computing device.However, the rendering process described for such online access does notresult in updating the rendered document on the client computing devicewhen the client computing device is offline. For the offline case, thesecure server, upon notification by a user of a connected clientcomputing device that the user wants access to the document whileoffline, may provide an encrypted version of the document along with alimited use encryption key. In that case, the offline file accessfacility 288 enables the client computing device to download theencrypted version of the document along with at least one limited-usekey. In this case, the client computing device will have access to theunderlying document file, at least one a limited, one-time basis, sothat the file can be edited within the viewer. The viewer may thusinclude appropriate editing functions, as well as viewing functions. Theparty wishing to share a document may wish to have the recipient user ofthe client computing device view, and perhaps even edit, a document, butoften it is desired to prevent further sharing of the document by therecipient. In order to prevent the user of the client computing devicefrom printing, saving, sending or copying the document while it isstored on the client computing device, the secure server may utilize thevirtual container DRM facility 209 to store the document in a virtualcontainer on the client computing device, the virtual container beingadapted such that the document can only be edited or viewed within theviewer. The document is now secured whether the client computing deviceis connected or not to the secure server, where user permissions may beseparately controlled for online rendering of a document and for offlineaccess to the document.

In embodiments, a method for secure viewing of a document may comprisingrendering, from a networked server-based computing device to a clientcomputing device when the client computing device maintains an onlineconnection to the networked server-based computing device, a documentcreated by an application as an actively rendered document in a clientdocument viewer running on the client computing device without the useof the application running on the client computing device; and upon arequest from the client computing device for offline viewing of thedocument, storing, on the networked server-based computing device, thedocument as an encrypted document along with a plurality of limited-useencryption keys, each of the plurality of limited-use encryption keysproviding access to the encrypted document a limited number of times,the encrypted document accessible as downloaded to the client computingdevice that is not connected to the network only through use of at leastone of the plurality of encryption keys within the limited number ofpermitted uses, wherein when the encrypted document is downloaded to theclient computing device, the encrypted document is stored in a virtualcontainer where commands from an operating system of the clientcomputing device for saving, copying, and printing of computer files arerestricted. Further, a user of the client computing device may accessthe encrypted document stored in the virtual container through the useof the at least one of the plurality of encryption keys, while theclient computing device is disconnected from the network.

Email Effectivity Facility

Email can be a convenient method for inviting an individual to view aresource, such as a file, on a secure data exchange. For instance, anemail may contain an embedded link, or similar element, allowing therecipient of the email to access a resource by clicking on the link andlogging into the secure exchange environment. However, emails may bestored for time periods that exceed the desired time for which access isintended to be permitted. This is particularly true across separatebusiness entities, where a transaction or other collaborative projectmay call for temporary sharing of information, but once the need ceases,access is no longer intended. For example, in mergers and acquisitionstransactions, temporary access may be allowed to designated individualsof a prospective buyer to confidential resources that reflect thecondition of a target seller in a “due diligence” process. This accessneeds to be revoked when the due diligence process ceases. In methodsand systems disclosed herein, an effective period may be specified foran email, so that once the effective period ceases (either based onexpiration of time, or based on triggering of a condition that ceasesthe effective period), the email is no longer effective to access theresource on the secure data exchange.

Further complicating exchange of information across business entitiesover time is the presence of multiple email addresses for a singleindividual. An individual may have different roles, reflected indifferent addresses (e.g., personal and business), or may have differentemail addresses associated with a single role (e.g., bill@companyx.comand William@companyx.com). In embodiments, an email effectivity facilitymay be provided in connection with the secure exchange environmentdisclosed herein, where email addresses are linked to the identity of auser, such as a designated individual who will receive email, and therelationship of the email addresses to the user are tracked over time toprovide a current association of email address to a designatedindividual. In embodiments, once email addresses are linked to a person(such as by a business entity associated with the person), then theperson may be allowed access to a resource from any current emailaddress, not just the email address to which a link or other accesscapability was initially sent. Similarly, all email addresses of a usermay be “de-commissioned,” and all email-based links renderedineffective, if the role of the individual changes, such as if theindividual leaves the business entity that is the intended recipient ofaccess rights.

Thus, in embodiments, access to data by a designated individual may bepermitted based on the union of (a) emails or email accounts that arecurrently effective (that is, within their applicable effective period)and (b) the set of resources for which any valid email address of thatdesignated individual has been granted access. In such embodiments, auser may readily access data relevant to multiple projects andresources, without needing to track down the particular email thatallowed the user access to a particular resource, yet the individual isnot allowed to access resources that have expired, or to accessresources in cases when the role of the individual has shifted(resulting in a change in the identity of the user and the accesspermissions allowed for all emails associated with that user).

Once an identity has been established for a user, that identity may betracked over time as the individual moves from company to company,eventually allowing a host to establish a comprehensive, authoritativecollection of identities and associated email addresses for a largenumber of individuals.

In embodiments, the same email address may be used at different timesfor two different individuals, in which case the methods and systems mayinclude further information, such as metadata, for tracking the realindividual that is associated with a particular address at a particulartime. Different effective periods may be used to confirm whichindividual is allowed access to particular resources. A person may havemultiple effectivity periods if they work at a company over twodifferent periods of time, e.g., hired January 2000, quit June 2005,then hired again in February 2008 and quit again in December 2012.

In embodiments, the email effectivity facility 294 may track identityand conditional access permissions over time for the different emailaddresses for the individual as they change roles, as well as trackingthe effective dates for those email addresses. The system may track theeffective date that a particular email account was active, and/orinactive, the effective date the email account was linked into the emaileffectivity facility, and the like. The email effectivity facility mayextend control of access beyond a user's current association with abusiness entity, such as an individual having had different emailaddresses for the different companies the individual has worked for,along with personal emails, each with effectivity conditions. The emaileffectivity facility may provide an authoritative source of workspaceidentity, tracking the plurality of email accounts and associated accessconditions, and keeping them associated with this one person, andcontrolling access that this person has over time in association witheach email.

The email effectivity facility may aid a user in managing a user's emailidentities over time, where the user's identity shifts over time, wherean individual shifts between roles (e.g., with respect to personal emailand work email, for example, or shifting from one company to another).The system may associate a user's permissions for access, editing, andother features based on a correct interpretation of the current role.For instance, an email sent to an individual with a link to content in adata room may have an effectivity date (e.g., the individual's access isbetween time 1 and time 2). That email and link may also be associatedwith a catalog of email addresses, so that if the user leaves that role,the link is no longer effective, even if the user attempts to activateit within the originally permissioned time range. For instance, the userleaving a role may be indicated in a catalog by de-permissioning thatemail address by the user's employer (or other sender of the email) andperhaps also triggered by the appearance of a new email address with adifferent company domain that is for the same person. In embodiments,the companies that granted the email account may validate the user'sworkspace identity, and provide a historical access to the workspaceidentity. In embodiments, effective dates and expiry dates may apply forpermissions as well as for documents. For instance, a user may set up arequest for proposal, and provide everyone access on an effective dateof Mar. 1. The user then sets an expiry date for Mar. 7, at which pointall permissions for access are terminated.

In embodiments, effectivity conditions may be managed by a host, such asan intermediate business entity, in response to inputs from multipledistinct business entities. A past employer may allow the individual toreceive emails, but not to access any company data, while a currentemployer may limit email access to time periods associated with specificroles or tasks delegated to an individual. Further, a non-employer, suchas a third party involved in a transaction with the company that employsthe individual, may set effectivity conditions on specific emailsdirected to the individual, such as allowing temporary access to thethird party's data in a secure exchange environment, such as to enablecollaboration or sharing between the third party and the individual'semployer. Thus, effectivity conditions for emails directed to anindividual may be managed on a per account, per sender, per project, orper employer basis, among other factors, by allowing employers, theindividual using the account, email senders (including third parties indifferent entities) and an intermediate host of an exchange environmentto set and manage such effectivity conditions.

Referring to FIG. 14, in embodiments an email effectivity facility 294may be provided for managing access conditions 1404 to resources in asecure exchange environment, where access to the resources is providedthrough email. In embodiments, methods and systems may use the emaileffectivity facility 294 to allow a user of a first business entity 1412to manage access 1414 by specifying conditions for email-based access toat least one resource in a collection of files 1402, wherein thecondition expresses (a) one or more effective periods 1406 for using anemail providing access to the resource and (b) a condition of emailaccess to the resource by a designated individual 1408 of a secondbusiness entity 1416, where the access permission may be assigned usinga specific email address 1418 of the designated individual and accessmay be provided by sending an email to that email address with a link, alog-in credential, or the like that enables access to the resource.Access confirmation for access to the resource, e.g., the file 1420, mayinclude confirmation steps, such as in a first step 1422 where theeffectiveness of the identity of the designated individual is confirmed(including based on linking various email addresses to that particularindividual) and a second step 1424 where entitlement to access aresource, such as the data file 1420, is confirmed (including checkingthe effectivity periods that were set for access to each of theresources by the user of the first business entity).

In an example, there may be an association 1426 between the identity1410 of a designated individual and each of multiple email addresses oraccounts 1428, each with effectivity periods 1406. Email accounts, orparticular emails bearing access credentials, may have a start date andan end date as their effectivity date range, such as when email accountsare no longer effective, have a future date range, and the like. Anemail account may also only have a start date, such as when aneffectivity period is still current, or has not yet begun. FIG. 14 showsan instance where an identity #1 has a file association with a file #1through email account #2. In this instance, the confirmation of identitywould be passed for access confirmation, but the step of confirmingentitlement to the data may fail, such as if it is currently outside theeffectivity period between start date #2 and end date #2. However, ifthe current time is within this date range, the designated individualwould have access to the file #1. The association of multiple emailaccounts with a single identity through the email effectivity facility294, enables a comprehensive management of a plurality of emailaccounts, especially important when the email accounts are conditionallyassociated with emails linked to files.

FIG. 14A shows a specific instance when a single business entity hasre-assigned a previously used email account name to a second user, suchas where a previous employee has a related name, such as rsmith.xyz.combeing used for a former employee Richard Smith and a current employeeRalph Smith. In this instance, the access confirmation would fail ifIdentity #2 tried to access File #1, where the email account name wouldpass, but the effectivity date range (e.g., equating to their time rangefor employment with the business entity) would not match, and so failingthe confirmation of entitlement to the file.

In embodiments, a method for managing access to a secure exchangeenvironment managed by an intermediate business entity through a useremail identity may comprise establishing a secure exchange server hostedby an intermediate business entity, wherein communications and access toa collection of files established by a first business entity are managedfor a second business entity; and establishing an email effectivityfacility that allows a user of the first business entity to specify acondition for email-based access to at least one resource in thecollection of files, wherein the condition expresses (a) an effectiveperiod for using an email providing access to the resource and (b) acondition of email access to the resource by a designated individual ofthe second business entity, wherein the access permission was assignedusing a specific email address of the designated individual. Inembodiments, multiple email addresses may be associated with theidentity of the designated individual of the second business entity. Thedesignated individual may be permitted access to the resource during theeffective period of the email that provided access from any currentemail account that is associated with the identity of the designatedindividual. Separate access conditions may be managed for each of themultiple email addresses of the designated individual. The first andsecond business entities may validate the designated individual'spermissions associated with the multiple email addresses. Permission toaccess information on the secure exchange server may be identified by anembedded link in an email from the user of the first business entity toan email address of the designated individual. The first business entitymay provide updates to the access conditions as an association of theuser of the second business entity with the first business entitychanges. The effective period may be a period of employment, a stage ofa transaction, and the like. The email effectivity facility may utilizea graphical user interface to manage the access conditions, such aswhere the graphical user interface indicates the status of the accessconditions, where the graphical user interface is integrated into athird-party application as an application program interface (API), andthe like. The effectivity condition may be a status of an email accountof the second business entity, and the status of the email account isstill monitored when the designated individual is no longer employed bythe second business entity.

E-Discovery Facility

Referring to FIG. 16, in embodiments an electronic discovery(e-discovery) facility 211 may be utilized by users 110 to facilitatethe discovery process for digital content 1612 stored in a network-basedcontent storage service 1610, such as in a cloud-based service. Inembodiments, a discovery request for digital content may be made by, inassociation with, for example, an investigation, a lawsuit, anarbitration, a mediation, an audit, or a dispute between entities. Inembodiments, a discovery request is for access to digital content by anagent, wherein the agent may be, for example, legal counsel, a legalagent, a paralegal, a legal assistant, a law clerk, a judicial agent, alaw enforcement agent, a government agent, an outside counsel, aninternal counsel, an internal agent, an auditor, an accountant, aforensic accountant, an expert witness, an employee, a consultant, or anenterprise knowledge worker. The digital content 1612 may be computerdata or other content, such as documents, presentations, spreadsheets,emails, blog entries, texts, calendar notes, meetings, social mediamessages, browser history, bookmarks, and the like.

The content discovery 1604 process may comprise the identification,preservation, collection, review, analysis, and production of content,such as enabled through content tracking 1602 provided by the system forcontent exchanged between users 110 and the network-based contentstorage service 1610. For instance, the electronic discovery facilitymay support or allow response to requirements of a discovery process incivil or criminal litigation that pertains to electronically storedinformation (ESI), such as with respect to an entity such as anindividual, a business, a government organization, a non-profitorganization, and the like. In this instance, when responding to alitigation request for discovery, enterprises must identify responsivedocuments, may place those documents on legal “hold” status to ensurethat data cannot be destroyed, and may need to transfer those documentswith associated metadata to an outside reviewer 1608, such as theirlegal counsel (which may be internal or outside counsel). The legalcounsel may then determine relevance and disposition of those documents.Documents may then be processed to facilitate the review and culling ofdocuments, for instance, using techniques such as keyword search, daterange, meta-data based search, and the like. The resulting documents maythen be submitted to opposing counsel, such as in formats that cannoteasily be altered, including PDF or TIFF.

In many regards, the use of third-party file sharing tools has madeelectronic discovery difficult or impractical, and in some casesimpossible. For example, any number of different commercial file storageresources (e.g. Dropbox) may be used by individuals of an enterprise forstoring and sending files and electronic messages to third parties, manyof which may be entirely outside the purview of enterprise InformationTechnology administrators. As a result, responding in a timely, completefashion to litigation requests becomes a challenge.

In embodiments, a set of tools may be made available to administrators612 of an on-line, network-based file sharing and collaboration servicethat are an aid in responding to a discovery request, such as alitigation request for electronic content, such as files, emails,documents, presentations, calendar notes, meetings, social mediamessages, browser history, bookmarks, and the like. These electronicdiscovery tools may be integrated into an existing administratorconsole, and made available to administrators with the appropriatemechanisms for maintaining legal privilege. From the administratorconsole, administrators may first be able to identify the relevantindividuals who may be in possession of relevant content. Alternately,the electronic discovery tools may be utilized directly as part ofcompliance with an electronic discovery reference model. Searching mayinclude the ability to search by user, by date range, by topic (e.g.,based on metadata or tags) and the like, to limit the scope of thesearch result. To facilitate content tracking 1602, the electronicdiscovery facility 211 may apply metadata, tags, global identifiers, andthe like, to content being stored in a network-based content storageservice 1610. For example, a user may 110 may store an electronicdocument in a commercial networked content storage service, such as oneof a plurality of cloud-based commercial storage providers, where thedocument is first sent to the electronic discovery facility 211 fortagging with a global identifier to facilitate tracking down thecontent. In addition, contact tracking may store information associatedwith the document, users that have access to the document, users thathave downloaded the document, and the like, where contact tracking 1602keeps track of where all copies and versions of the document reside.Users and/or content may be searched directly, such as through a userapplication or from the administrator console. Once identified, theresulting content may be placed on legal hold, where a legal holdprevents content from being destroyed or modified, such as to protectand document the chain of custody. In embodiments, content with rightsmanagement encoding (e.g., information rights management (IRM), digitalrights management (DRM), and rights management service (RMS)) may beplaced on legal hold through rights management based controls, such aswherever the content is currently stored, as described in thisdisclosure. Once placed on hold, those identified electronic content maybe provided to outside reviewers (e.g. legal counsel) by granting themaccess directly to the content as they reside in the file sharingservice. The outside reviewer may choose to use native search,de-duplication techniques, and analytics tools to further cull thecontent set.

In embodiments, the relevant content that result from the search processmay be exported to removable media as native files (also referred to as‘petrified’ files) in JPG or TIFF format to prevent data spoilage. Somecontent may have a mix of relevant content and other content that needsto be redacted, or for which portions may be reviewed only by a limitedset of eyes for the counter-party to a litigation or other dispute. Forexample, technology trade secrets in an intellectual property disputemay be limited to “counsel's eyes only,” so that non-attorneyindividuals of the counter-party are not supposed to see trade secretportions of materials. In such cases, document editing tools and rightsmanagement tools may be used, such as in a secure exchange, to blockcertain portions of content from access, except by individuals that haveappropriate access credentials to view the content.

This identification, preservation, collection, processing, review,optional redaction, and production of electronic content may beconducted through a file sharing service administrator console, throughan application, or if required, may allow the user or administrator toidentify, legal hold, redact, and export content for review in contentreview platforms of their choosing. In this way, the culled set ofcontent may be shared with outside reviewers 1608 without the need toexport physical media, and as such, may be shared in place withoutconcerns that the content or chain of custody will be modified or thatunauthorized users will have access to prohibited portions of content.

Rules-Based Workflow Management within an Exchange

In embodiments, a rules-based workflow management facility 219 may beprovided within a secure exchange. For instance, in the case of aprivate equity fund, a user may be executing a capital call. Rules maybe used to automatically permission, automatically alert, and the like,such as for example, alerting those individuals associated with thecapital call. In embodiments, the system may trigger rules-based actionson at least one document, where the at least one document is mined forinformation, such as the investor's name, the deal, the nature of thedeal, and the like. Based on this information the system may create agroup, such as based on the investor's name. For instance, creation orselection of a workflow may be based on this information and the rulesestablished therefor. Other workflows may relate to completion of debtor equity offerings (including initial public offerings), completion ofprivate equity and other investment transactions, completion of lendingtransactions of various types, syndication of transactions of varioustypes, mergers and acquisitions transactions, and others. A set ofworkflow rules for each may be based on organizational policies,transaction terms and conditions, and legal/regulatory requirements.Under such rules, an exchange, such as for a particular transaction, maybe automatically provisioned with a suitable content organizationstructure (e.g., a set of files named with standard naming conventionsappropriate for various content normally needed for that type oftransaction); individuals having defined roles within each enterprise(such as determined by contact information stored and/or associated withan exchange) may be prompted to populate and/or review the contentstructure with appropriate enterprise content; and individuals havingdefined roles within each enterprise may be automatically providedappropriate access credentials to access the content. Rules may alsotrigger actions based on conditions, such as providing additional accessand/or prompting in response to completion of actions (e.g., prompting areviewer to provide a summary report to a supervisor when the reviewerhas completed review of a file).

Improved Methods and Systems for Providing Delivery of Services

In embodiments, improved delivery of services may be provided throughthe use of a delivery of service facility 221 as shown in FIG. 2alayered over an application program interface (API) layer that is ableto significantly accelerate API-based processes. The delivery of servicefacility may include a bulk operations toolkit that provides bulkoperations and various spreadsheet driven operations, where operationsteps are validated. The toolkit may provide real-time validation ofinputs to an exchange, so a client is able to receive real-timeconfirmation of the results. The system may enable various operations tobe assembled together. The system may also allow a user to set a varietyof criteria and transfer them from one exchange to another. The toolkitmay include client-specific tools, such as a customer alerts tool, aprocess steps consolidation tool, and the like. For instance, aclient-specific tool may be created to create and populate fieldinformation for certification, ingest spreadsheet content, and create anexchange, all in one process. In embodiments, the delivery of servicefacility may provide a bulk operations toolkit for an exchange, theability to push custom alerts up to multiple exchanges in real-time, andthe like. In embodiments, the system may enable the transfer of datafrom an exchange via metadata, such as with options to transfer customfields or their values.

Protected Drive with Encrypted Content and Auditable Access History

In embodiments, content may be stored on a secure drive on the exchangeserver through a protected drive facility 223. This secure drive mayalso be replicated to an open drive, such as on a user's hard drive. Thesecure drive may be accessible to anyone who can access it, where thesecure exchange server provides a managed service offering resident onthe computer platform hosting the encrypted managed device. The drivemay have security policies, be remotely administered, provide completetracking of what goes in or goes out, and the like. Accesses to thedrive may be monitored and recorded in an auditable record, includingbulk copies. As such, if an unauthorized user gets to the drive, itwould be encrypted and so unreadable. Thus, the drive may provide asecure storage facility that is encrypted, remotely managed, policymanaged, and the like, providing the user with a controlled securestorage.

Virtual Drive Facility

In embodiments, a secure drive on the exchange server may be replicatedto a virtual drive through a virtual drive facility 225, such as visibleand accessible from a user's desktop computer. In an example, this wouldallow legal teams to drag emails into an exchange directly or do thesame thing from a desktop in a more integrated experience than if theyhad to work with a dedicated application. In this way the files may bedropped into a secure repository directly from the desktop. The virtualdrive may also be integrated with the browser of the user's computer.

Revision Timeline for Handling Version Conflicts

In embodiments, the system may provide for a visual revision timelineuser interface through a revision timeline facility 227, such as forviewing and resolving document version conflicts. Through use of thevisual revision timeline, the system may be able to provide the userwith a view into when revisions occurred, and aid in determining how toresolve conflicts between overlapping revisions, and when to merge thechanges, thus making collaboration easier. For instance, the system mayprovide a visual view of when a revision branching occurred between twoor more users. Looking at a visual timeline of document versions withsnippets of conflicts may allow one user to determine if a conflictexists, and whether to merge the changes from another user, perhapswithout looking at the source application. For instance, if a userchanged something from italics to bold, the system could help classifywhether that change is a conflict that needs to be resolved. That is,there may be different levels of revisions with different conflictresolution priorities, such as formatting level conflicts, content-levelconflicts, and the like. Content-level conflicts might be resolved, butif content and formatting changes get mixed together, the system mayhave facilities to parse these potential conflicts out, such as bycategorizing them, applying rules to determine what is a conflict,perform automatic conflict resolution on one category of conflict butquery the user for others, and the like. The visual revision timelineuser interface may make it simpler for a user to see what changes haveoccurred to a document in a secure way.

Collections User Interface for Organizing Work Streams

In embodiments, a collections user interface may be provided fororganizing work streams that allows dragging and dropping of assets,users, and the like, to create automatic permissioning. In this way, auser may be able to utilize a drag and drop action to create‘collections’. For instance, to create a folder, new work stream, or thelike, a user may drag one entity on top of the other. A user may createa collection of work streams that they drag items into (e.g., other workstreams, contacts, assets, and the like). In this way, a user may dragassets and the people into a collection and automatically createpermissions. In an embodiment, a collection will automatically providepermission to all individuals whose contact information isdragged/dropped into the collection, for the individuals to access allcontent that is dragged/dropped into the collections. Collections may beannotated, such as with messages to the respective contacts. Forexample, if a partner in a law firm wants two associates to review a setof documents in connection with an M&A due diligence process, thepartner may create a new collection in an exchange, drag and drop thedocuments (e.g., from a section of an exchange) relating to a relevanttopic into the collection, drag and drop the names of the two associatesinto the collection, and write a message to the collection instructingthe associates which documents each is to review. In embodiments thecreator/manager of a collection may provide other settings, such asallowing read/only access, having time-limited access, or having otherfeatures described throughout this disclosure.

Three Dimensional Viewing Facility

In embodiments, a 3D viewing facility 229 may be provided, such as forviewing secure 3D documents that are being shared though the secureexchange server. The 3D viewing facility may provide facilities forrendering a 3D document in a secure manner consistent with methods andsystems described herein in relation to other digital content, includingsecure viewing protection, un-sharing control, and the like. The 3Dviewing facility may provide a conversion facility for converting CADdrawings into the 3D rendering files for viewing on a user's computingdevice, mobile computing device, and the like. The 3D viewing facilitymay provide a storage facility for source CAD drawings and/or the 3Dfiles. The 3D viewing facility may provide for a permissioningmechanism, auditing mechanism, distribution, share/unshared facilities,a business process based on work streams, and the like. In an example, abusiness may be going out for bids on a design to a number of vendors,and through the secure exchange facility and 3D viewing facility may beable to share the 3D files for the design for the bidding process. Oncethe vendor is selected, the business may remove shared access to the 3Dfiles, allowing the 3D files to be completely unshared from the losingvendors, such as described herein. In this way, the businesses, people,and devices that the files are shared with can be controlled, as well asun-sharing as needs arise.

Metadata Sharing Facility

In embodiments, a metadata sharing facility 231 may be provided, wheremetadata is sharable without the need to share the documents, files,processes, applications, and the like, that the metadata is associatedwith. For instance, metadata may be associated with a document that hasbeen shared, such as for scheduling, viewing, reviewing, signing,status, and the like. This metadata may provide insight into theprogress of a document review, a signature process, a bidding process, amanufacturing process, a supply-chain status, and the like, without theneed to have the document or application that generated the document.Through being able to share metadata, such as across enterprise firewallboundaries, a user may be able to gain insight through the monitoring ofthe metadata. In an example, metadata may be associated with a documentthat is in a signature cycle, where each time the document is forwarded,reviewed, viewed, signed, and the like, the metadata is updated. Thismetadata may then be forwarded to the metadata sharing facility where areport, dashboard updates, alerts, notifications, and the like, may beprovided to a user that is monitoring the progress of the signatureprocess. Thus, an individual may be able to indicate whether thesignature cycle is nearing completion, without having to have access tothe content of the document. This is a simple illustrative example, butone skilled in the art will recognize that this process may be used tomonitor much more complex exchanges and processes, such as betweenenterprise partners, buyers and sellers, and the like, where differentusers have different applications, but through metadata sharing theremay be no need for users to have the application in order to have a viewof the metadata and its embedded information. With this system in place,a more time-responsive process may be in place that allows real-timeupdates of digital content events, and thus enables a user with a viewthat helps provide real-time transparency of activity to a document,work stream, process, collaboration, and the like.

In embodiments, the metadata sharing facility may provide for a platformfor managing assets, policies, work flow, object life cycles, auditing,and the like, such as for collaboration situations. For instance, a usermay assign metadata to a community of buyers and documents (e.g.,marketing promotions) to those buyers who have registered as such. Themetadata associated with those documents may then be sent back to thesender to help assess how the document is being received, such asthrough pages viewed, time of viewing, number of times viewed, stored,copied, distributed, signed, deleted, and the like. In another instance,documents that represent assets may be assigned metadata for monitoring,such as drawings, CAD models, change requests, deals, and the like. Inanother instance, metadata associated with documents may provideinformation about whom the document is being viewed by, and whom thatperson is associated with. From this information, relationships may bedetermined, such as how these people are related to one another, whythey are connected, and the like. Related people may then be identifiedas potential contacts in related projects, deals, sales, and the like.Metadata may then be augmented with attributes, fields, and the like, torecord these relationships, and thus build as a metadata-held profileassociated with the document. In another instance, metadata may includepolicy information, such as for the life cycle steps or states that adocument or entity associated with the document goes through. Forexample, a form may have different steps associated with the process ofusing a form, where metadata is associated with the form, the forms use,actions take with the form, and the like. The system may then look at anobject that shows up in the form with the relevant data for a givenstep, stages and relevant actions for each stage, approval steps, peoplethat are allowed to do the next step, and the like. In another instance,metadata may be used to track the lifecycle of an object through itssteps, such as in a deal, where a document has a lifecycle. There may ben-levels of hierarchy in the metadata model, where an action, such as aworkflow, may be developed from the metadata at each level. Forinstance, a lifecycle may have states (e.g., done, not done, approved,not approved) as a sub-level of a workflow. In another instance,metadata sharing-tracking may be useful when assets need to know abouttheir relationships to other assets. For instance, a document might knowabout another document (e.g., the PDF-converted version of the samedocument). A document might know about a format relationship, if it isan assembly for a 3D model, about the children components of a model,and the like. In embodiments, these relationships might in some casesinherit permissions (e.g., if documents are just two versions of thesame content, a PDF version may inherit permissions from the wordprocessor version) while others might not inherit permissions (e.g., acomponent model might not inherit permissions from the parent model).The system may build asset permissioning relationships into and from themetadata.

Investor Portal

In embodiments, an investor portal may be provided as an investorcommunications platform for marketing and communicating with theirclients. The investor portal may fill a need for financial servicesorganizations. For instance, fund managers need to navigate considerablechallenges to raise capital, satisfy important investors, and hold ontoassets. To compete effectively, these firms need a client-reportinginfrastructure that can accommodate information seeking, sophisticatedinvestors, and the like, and maintain them as clients. The investorportal provides a new way to engage with the investor community, anddoes so with scalability, security and control, including contentmanagement, branding and data delivery tools to help financial managerscompete effectively for institutional assets. The investor portal mayprovide information to investors immediately via a user interface that'scustomizable to enhance the user's brand while meeting reporting needsof institutional investors. The investor portal may allow forpermissioning in a similar way as in an exchange or through thedashboard as described herein. Permissions for these differentenvironments may be automatically matched, such as with a matchingalgorithm.

Location-Based Storage

In embodiments, a user, such as an enterprise user, may store content toa secure storage facility 233 through the exchange server. Upon requestto the exchange server the content may be retrieved and then sent to theuser. This process creates traffic through the exchange server, whichcombined with a plurality of other such requests, may create bandwidthissues at the exchange server. However, the exchange server may storethe location of content locally such that when the enterprise userrequests the content the exchange user provides the enterprise user withthe location for direct access, such as with a time-based token that isgood for a period of time. Then the user is able to directly access thecontent with the secure storage facility, thus removing the exchangeserver from the pathway, and thus eliminating the bandwidth usagethrough the exchange server. In embodiments, the content may beencrypted while stored, while in transport, and the like, such as in arequest for the content, sharing the content, synchronizing the contentwith devices, and the like.

In embodiments, there may be a plurality of secure storage facilities inwhich user content may be stored, and to further reduce traffic and/ortime-latency, the exchange server may direct the storage of the contentto a location that is closest to the user, such as either geographicallyor through a network access assessment between the plurality of securestorage facilities and the location or network connection of the user,thus finding the best connection between the requester and the storagefacility and improving access time. This location preference may bestored in association with the content through permission attributes,which then determines where the content is to be stored. Permissionattributes may also determine other parameters in association with thecontent, such as who has access to the content, what devices arepermitted to access the content, date-time limitations on access to thecontent, and the like.

Comment Notification

In embodiments, a comment notification facility 235 may be provided,where a user is directed, highlighted, linked, and the like, to acomment in a document created by another user. For instance, a firstuser may send a document to a second user for review and comment. Thesecond user may then make a comment in the document, and the first useris notified of the comment through the comment notification facility.Notification may be provided to the first user upon the second usersending back the document to the first user, provided to the first userafter the second user has saved their comments to the document, providedin near real-time to the first user when the second user makes thecomment, and the like. The notification may take the form of atransmission of the comment to the first user, such as through email,through the dashboard, through a text, when the first user receives thedocument, and the like. The notification may include a link that bringsthe first user to the comment within the document, such as providing alink to the comment so that the first user only need one-click on avisual icon, link, and the like, and the first user is brought to thecomment. The comment may be highlighted in some way so that the firstuser clearly sees the comment, such as the comment being colored font,colored highlighting, underlined, flashing, and the like. The first usermay be provided a highlighted comment to a document so that they aredirected immediately to an animated-highlighted version of the commentfor expedited review. By providing an expedited access to a commentthrough the comment notification facility, the users may be providedwith a method of review and comment that is quicker and easier to usethan traditional methods.

Device Pinning

In embodiments, a device pinning facility may be provided that enablesthe enforcement of document permissions restricting a user fromaccessing a document from any computer other than the computer fromwhich the user first accessed the document. The device pinning facilitymay be implemented without any plug-ins, agents, or any other additionalsoftware installation on a client machine, end user device, and thelike.

Encryption

In embodiments, the exchange may only be accessed by authorizedcomputers using an acceptable log-in procedure, including user name andpassword. Communications within the exchange may establish acommunication session based upon a selected security protocol, andthereafter messages are transmitted between using such secureencryption. Communications may be exchanged via a secure encryptedcommunication session using a selected encryption protocol, and may denyaccess if a secure session cannot be established at a desired securelevel. In embodiments, encryption may include the implementation ofcipher block chaining (CBC) with keys of various lengths, e.g., with256-bit encryption keys. The host server may offer a high level ofsecurity for all data by employing substantially secure networkconnections, and by using security and encryption technologies developedfor networks such as may be readily incorporated in the encryptionfacility 232. Encryption of files may be provided in a cloud (e.g.,enterprise-to-cloud, cloud-to-cloud, cloud to enterprise, for alldevices). Encryption may be implemented without any plug-ins, agents, orany other additional software installation on a client machine, end userdevice, and the like, such as in combination with DRM protection,content sharing (e.g., user-to-user, user-to-many, many-to-many),watermarking, and the like.

Cross-Enterprise Collaboration Combined with Unified Activity Workspaces

In embodiments, a cross-enterprise collaboration facility 298 mayinclude unified activity workspaces, such as content management,activity management, workflow management, identity, entitlement,enforcement, and the like, where these activities may plug into thesystem as modules. This extended environment may also extend beyond theenterprise firewall, allowing user access when outside the securenetwork of the enterprise.

Cross-enterprise collaboration in a networked secure collaborativeexchange environment refers to the methods and systems disclosed herein,and elements thereof, in the general domain involving securecollaboration among individuals (e.g., workers) across two or morebusiness entities across enterprise firewalls and other elements thatwould otherwise provide security if the individuals were working insidethe network of one company. Unified workspaces may be provided for agiven type of activity within the secure collaborative exchangeenvironment that can be accessed from various types of systems, withfull management of the activities that happen in the workspace (e.g.,permissioning of users and groups, control of access, tracking andauditing). For that selected type of activity, all of the necessaryresources may be organized so that the activity type may be ‘pluggable’into the workspace. Resources that enable the set of capabilities foreach type of activity may be in blocks, plug-ins, sets of services, andthe like, that can be pulled for use by the workspace, such as from thecloud, from behind a firewall, or from another resource as needed toassemble the ‘pluggable’ activity for the workspace.

Referring to FIG. 42, a workflow management workspace may have pluggableresources to establish and drive the sequence of a workflow, such as forcontent, entitlement, identity, workflow/case management, and the like.Connectivity of these pluggable resources may be federated together,such as at an integration later, a platform layer, and the like. Thepluggable workflow management workspace may provide a many-to-manycollaborative environment that may be located beyond the firewall in asecure, auditable collaborative service. This structure may allow forvirtually unlimited scalability, extensibility, specialization, and thelike. Through the flexibility of this system, customers may providetheir own content, entitlement, workflow, identity, and the like, whilethe system provides compliance across the established domain. Inembodiments, customers may choose to build their system outside theirfirewall (e.g., for multiple enterprise applications) or inside theirfirewall (e.g., for a content domain controlled by a single enterprise).

Resources may also be provided for identifying the sequence of aworkflow (e.g., using Gantt charts, visual tools for depicting flowchart sequences of work (e.g., Microsoft® Visio®), and the like);resources for identifying the input content used at each step in thesequence and the output content produced at each step in the sequence;resources for permissioning the content and issuing appropriatecredentials for the content, possibly with triggers based on the timingand sequence of the workflow (e.g., by user, by workgroup, byenterprise, and the like); resources for associating individuals withresponsibilities for executing, reviewing and/or approving thecompletion of the steps in the workflow; and resources for reporting onthe status of the workflow (at individual steps, pending status,progress toward completion, and completion). Once in the workflowmanagement workspace, individuals may use the pluggable resources tocreate the workflow for a given project, and the workspace itself maypull the enabling resources from the appropriate systems (e.g., a cloudor enterprise system) to perform the function of that resource.

In embodiments there may be a plurality of resources that would beappropriate for each kind of workspace. The content management workspacemay have various resources that are appropriate for tracking thecreation, modification, development, approval, publication, use ofcontent, and the like.

Action Checking

In embodiments, an action checking facility 241 may be provided thatmanages actions to be performed with respect to application capabilitiesresident on a user's computing device. The action checking facility mayinclude an action command process, such as a pre-check, check, action,post-action, and the like. For instance, an action may be a capabilityprovided by the system. A pre-check may determine whether or not topresent that capability (e.g., based on licensing, what applications areinstalled, whether that behavior or capability should be exposed), suchas in the determination whether to display a particular dashboardbutton. For example, if a user is allowed to read, annotate and approvecontent, but not take other actions (such as modification or sending thecontent), then a button/icon for approval might be included, whilebuttons/icons for printing, sending, or the like might be disabled, oromitted from the interface of the application, based on the pre-checkrelated to deployment of the application to that user. Thus, anapplication for handling secure content may be configured, based on apre-check, to have the correct set of capabilities allowed for aparticular user when interacting with particular content. An actioncheck may involve the system enabling a host to install business logicthat requires a particular action to occur before another action canhappen, that prevents an action from occurring if logic dictates, or thelike. Thus, workflows can be enabled by action checks that followclient-defined business logic. Post-action checks may enable alerts,sending of logs of actions taken, transferring of data to anothersystem, deletion of data that is no longer relevant, reporting oncompletion of workflows, initiation of next sets of actions, and thelike. The action checking facility may provide a broad set of hooks forextensions from the system, such as from business systems, professionalservices, client services, customers, partners, and the like, that canprovide business logic, work flows, and the like. Each action checkingprocess (e.g., pre-check, check, action, post) may include a list ofitems to check on. For example, if an application is being installed,pre-check could determine if the application is currently installed inthe system, and if so, then display a control button associated with theapplication. The action checking facility functionality may beinterconnected with the application layer, the platform layer,orchestration services, and the like. In embodiments, the actionchecking facility may provide patterns and constructs as to howcapabilities of how aspects of the system will be rendered to the user,such as enabled in a composite services layer.

Secure Mobile Device Environment

Referring to FIG. 43, in embodiments a secure mobile device facility 243may be provided to manage a trusted environment policy 4312 for aplurality of mobile devices 4302 (e.g., trusted devices as identified bythe secure mobile device facility), where the plurality of mobiledevices 4302 are able to securely inter-communicate with each otherwithin a trusted environment 4304. The secure mobile device facility 243may enable users with mobile devices, such as smart phones, to moreeasily communicate securely (e.g., communications, file transfers) onceeach of the mobile devices has been verified as a trusted device. Thetrusted environment policy 4312 may establish what mobile devices 4302are included in a trusted environment, the bounds of the trustedenvironment, the constraints upon mobile devices within the trustedenvironment, and the like, where a mobile device may be enabled tooperate within more than one trusted environment, and where trustedenvironments may have overlapping bounds. The ‘bounds’ of the trustedenvironment may be defined as a physical location (e.g., range around aphysical location point, a geographically defined area or region), as anetwork connection (e.g., connected to a trusted network), as proximityto another mobile device of the trusted environment (e.g., withinBluetooth range, near-field communication range, RFID tag reader range),and the like. Constraints upon mobile devices operating within a trustedenvironment may limit communications connectivity (e.g., only availableif the mobile device is online), require updated software (e.g., havingsoftware current with respect to available updates, versions, and thelike), require an anti-malware scan within a defined period of time(e.g., having an anti-virus scanner that has scanned the mobile devicewithin the last day), require that authentication procedures be followedand/or verified (e.g., by verification that the device is being operatedby the owner), and the like. Bounds and constraints for each trustedenvironment 4304 may be stored in a trusted environment database 4314.

The inter-environment communications connectivity 4306 between mobiledevices 4302 of a trusted environment 4304 may be through any wirelessconnection media approved by the trusted environment policy 4312, suchas through a wireless network, WiFi connection, Bluetooth connection,near-field communications (NFC), cellular network, and the like.Communications between mobile devices within a trusted environment maybe through a peer-to-peer (P2P) network, where communications aredecentralized and distributed, and may offline with respect toconnectivity with the secure mobile device facility 243 (e.g., such as agroup of mobile devices being collectively off-line, but able tocommunicate P2P. The network 4316 connection of the plurality of mobiledevices 4302 to the secure mobile device facility 243 may be via theInternet, a wireless network, WiFi, cellular network, and the like.

In embodiments, the trusted environment policy may allow mobile devices4302 within a trusted environment 4304 to operate in either aconstrained or unconstrained mode, where the mobile devices may utilizepartitioned secure memories, cryptographic methods, multi-level accesscontrols, and the like, to manage operations in a constrained versusunconstrained mode. For instance, a mobile device may have secure andunsecure memory allocations and may use separate communicationsprotocols for communicating with trusted devices versus devices thathave not been certified as trusted devices. A mobile device 4302 may bedetermined to be a trusted device for possible use in a trustedenvironment 4304 through a certification procedure, such as establishinga key certificate to confirm that the device is a trusted device. When afirst and second mobile device 4302 initiate a secure exchange within atrusted environment 4304, a multi-factor authentication process may beexecuted, such as including a password (e.g., with a single sign-on formultiple trusted environments), a token exchange, location, personalknowledge answer, biometric authentication (e.g., fingerprint), and thelike. However, the trusted environment policy may require only a singleverification, such as verifying that both the first and second mobiledevices 4302 are trusted devices as defined by the trusted environmentpolicy 4312, and thereafter allow the devices to exchange files withoutfurther security verification steps, thus establishing a secure dynamicgroup membership amongst the two trusted devices. The trustedenvironment policy may dictate secure operations periods, such as‘crypto-periods’ for temporal exchange constraints. For instance, filesallowed to be exchanged only between the hours of 8:00 a.m. and 5:00p.m., and the files must be encrypted.

In a use-case example, a trusted environment may be defined as a team ofindividuals working for a company, where the bounds include all of theirmobile devices being certified as trusted devices, are only allowed tocommunicate securely while located at the company (e.g., determined byGPS, network connectivity), and require an initial multi-factorauthentication including a biometric authentication with the device, asingle sign-on with the secure mobile device facility 243, and anexchange of a token during sign-in. In another example, the team may bethe Board of the company, and the physical location may be constrainedto the Board Room. In another example the team may be a combination ofcompany members and visiting counsel to the company in alocation-limited diligence project. In another example, the team may bespread out across the world, and the constraints include certainidentified trusted network connections, encryption protocols, andbiometric verifications. The secure mobile device facility 243 mayenable a plurality of mobile devices 4302 to operate ‘freely’ withinpre-established bounds and constraints, making secure ongoingcollaboration possible without the necessity of secure procedures foreach communication.

Workstream Synchronization

In embodiments, a workstream synchronization facility 247 may providethe ability for a user's secure collaboration container (e.g., such asstored in the cloud) to be synchronized onto the user's desktopworkstream channels, such as for conflicts management. The resultingsynchronized container of work available on the user's desktop may allowthe collaborating group of users to synchronize files, events,calendars, activity feeds, and the like. Synchronization may also takethe current risk profile of a computing device into account (e.g., auser is on travel in China versus they are in the corporate homeoffice). A notification component may be provided that enables multipleusers to work together more efficiently by users letting each other knowwhat actions are occurring in the work container (e.g., a messagingfunction associated with the container. A proactive component may beprovided that pushes an alert to a user's desktop (e.g., rather thanjust an email). Alerts may also be provided based on changes to thecontainer, that on-going work is occurring (e.g., to create awarenessthat someone else is working on files in the container), and the like.

Contextual Sharing Facility

Referring to FIG. 44, in embodiments a contextual sharing facility 249may be provided that manages the sharing of data based on the contextualenvironment 4404 of a user, such as based on what computing device 4406the user is utilizing when attempting to share information (e.g.,enterprise computing device, enterprise mobile device, home computingdevice, personal mobile device), the location 4408 of the computingdevice (e.g., enterprise facility, personal residence, public location,competitor location, on travel, in a foreign country), the user'scurrent activity state 4410 (e.g., at work, on work travel, on personaltime, on personal travel), network conditions 4412 (e.g., connected to atrusted network, using a trusted IP address, connected to a publicnetwork, operating offline of a network), proximity 4414 (e.g., nearteam members, near legal counsel, near competitors, near publicdevices), time (e.g., during regular work hours, on weekends, duringnormal sleep time), based on a restrictive list (e.g., a white list, ablack list, a combined listing of individuals by sharing privilege), andthe like. For instance, a user may be constrained from sharinginformation with a second user because the first user is at home, butwhose sharing privileges become unconstrained when they get to work. Thecontextual sharing facility may be utilized in file sharing orworkstream collaboration, applied to individuals of the same ordifferent enterprises, utilized for managing the sharing as a usertransitions between work and personal use, utilized to restrict or toenhance sharing opportunities, and the like. For instance, thecontextual sharing facility 249 may be applied to sharing in aworkstream, where sharing may be restricted based on the conditionsunder which users are working. However, because the users contributingto the workstream may have disparate home-office locations, thecontextual sharing facility may enhance sharing by alerting users ofchanges in the environment of other users that may foster sharing, suchas alerting another user of the workstream that a user is currently nearthe same location, and so encouraging an opportunity for directinteraction. The contextual sharing facility may also apply to otheraccess related facilities as described herein, such as for managing thesynchronization of documents to a computing device, to determine accesscontrol to files, to determine viewing privileges of a document, tocontrol e-signature privileges, secure viewing on a mobile device, andthe like.

The contextual sharing facility may allow, restrict, deny, and the like,the sharing of information with a second user based upon the parameters4406, 4408, 4410, 4412, 4414 or other contextual environment parametersunder which users finds themselves. The second user may have contextualsharing constraints placed upon them as based upon their contextualenvironment 4404, or the second user may be an unconstrained user 4416.For instance, two users, attempting to share information between them,may both be operating under sharing constraints placed upon them bydifferent contextual environments. The first user may, for instance, beusing their personal mobile device (e.g., their smart phone) connectedto a public network on personal domestic travel, and the second user maybe on an enterprise mobile device (e.g., their company laptop), at acompetitor location. In this instance, the contextual sharing facilitymay determine the sharing privileges between the two users based on bothcontextual environments, such as one sharing level for informationallowed to be shared from the first user to the second user, and asecond sharing level for information allowed to be shared from thesecond user to the first user.

An unconstrained user 4416 may also have sharing allowed, restricted,denied, and the like, with a second user whose ability to be shared withis constrained by their contextual environment 4404. For instance, allusers may be considered to be unconstrained (or relativelyunconstrained) under a certain set of conditions, such as being at theirown desk in their enterprise facility connected to the trustedenterprise network. However, when an unconstrained user attempts toshare data with a user constrained by a contextual environment, sharingmay be restricted. One of the contextual environment's parameters mayalso be time, such as a user being able to share under certain parameterconditions during regular working hours. A set of conditions may be setfor special team members, or types of team members, such as for legalcounsel (e.g., as determined by proximity to the legal counsel or for alocation of the legal counsel's work place). In this instance, a usermay only be allowed to share information under these limited conditions,where outside of these conditions the information is protected frombeing shared. The ability to disallow sharing may provide protection forprivate information not only through transfer of the information, butalso for storage of information. For instance, during conditions wheresharing is not allowed, information stored on the computing device maybe protected (e.g., via encryption, stored in a virtual or protecteddrive), such as from someone trying to hack their way into the computingdevice to steal information. One example of information where privacymay be enhanced with contextual restrictions is medical information. Thecontextual sharing facility may provide a restricted access to themedical information stored on a computing device (e.g., a mobilecomputing device) of a patient, doctor, or other user that has need tostore a patient's medical information. For instance, medical informationmay only be enabled for sharing from a patient to a doctor when thepatient is in the doctor's office, and otherwise it is placed in asecure storage container on the patient's computing device. Through useof the contextual sharing facility, sharing privileges, as well asinformation protection states, may dynamically shift as the context ofthe user's environment changes.

In embodiments, a combination of the user-selected and automaticparameter-determining facilities through the computing device maydetermine the user's current environmental context for the purposes ofsharing. For instance, location 4408 may be determined by GPS functionsone the device (e.g., GPS functions provided on a smart phone). Thecomputing device 4406 being used may be determined automatically, orinput one time into the system for each device the user accesses. Thecomputing device may also be able to automatically determine networkconditions 4412. User activity 4410 may be input by the user, determinedby a combination of calendar date and time, input through voice command,and the like. Proximity 4414 may be input by the user, automaticallydetected though services provided by a cellular network serviceprovider, determined through near-field communications (NFC), determinedthrough the user of RFID technology, automatically detected throughnetwork services, and the like.

In embodiments, the contextual sharing facility 249 may reside on asecure server, where the users' computing devices provide the parametersthat comprise the current contextual environment. The server-basedcontextual sharing facility may then continuously gather contextualparameters from the users' computing devices, and manage the sharingpermissions for devices. In another embodiment, the contextual sharingfacility may be located, at least in part, on the user's computingdevice. With this configuration, the contextual sharing facilityresiding on the user's computing device may provide the user's currentcontextual environment state to a server-portion of the contextualsharing facility, or directly to other user computing devices, such asdirectly to another user whose computing device also has access to acontextual sharing facility (e.g., located on the second user'scomputing device, located on a server across a network). For instance, afirst and second computing device may both be running client versions ofthe contextual sharing facility, where they can both assess the other'scontextual environment information for determination of sharingpermissions with the other. In this way, the contextual sharing facilitymay provide for dynamic group sharing privileges, where a group'ssharing privileges are determined dynamically through the contextualsharing facility (e.g., through client and/or server-based facilities),and thus not require permissions to be stored in a database forretrieval. So a group of individuals, each with access to a contextualsharing facility, may share information amongst themselves, such as uponmeeting, based on each of their permissions determined by their currentenvironment.

In embodiments, the contextual sharing facility may provide a userinterface that provides a status of other users' contextualenvironments; so as to help manage sharing planning between users. Forinstance, a group of users may be a sales group, where individuals fromthe sales group are often out of the office making sales calls. In thisinstance, users' environments may continually change, such as being atthe location of another company, on foreign travel, working from apublic WiFi, at the home office, working from a personal residence, andthe like, where it may be desirable to restrict sharing of informationunder some environmental states. In another instance, the group of usersmay be attorneys, where much of the information being shared isconfidential to only one client, and where a strict policy related tosharing constraints needs to be in place. For example, privilegedinformation, such as medical information, sensitive company information,information relevant to a business deal, or the like, may only be sharedwhen an attorney is in the room, or not shared except when specifiedother individuals are present (e.g., CEO, in-house counsel). Not onlycan the contextual sharing facility automatically aid in preventingundesirable sharing conditions, but through the user interface users maybe able to track changing environmental sharing conditions that allowusers to better plan sharing. For example, a personal assistant to anattorney may monitor the environmental conditions for the attorney, andonly attempts sharing with the attorney when the attorney is in anenvironmental state to accept sharing of confidential materials. Inembodiments, the user interface may include visual indicators fordifferent environmental states of different users, such as color-codingfor different combined states that may be customizable for each user orgroup of users. For instance, a green colored visual indicator mayindicate that the attorney is in an environmental state that permitsunconstrained transfer of confidential information (e.g., not currentlyat a client site, and on a trusted network). The user interface mayprovide for status alerts, messaging, personal setup of environmentalconditions with respect to sharing, visibility into policy, and thelike. In embodiments, the contextual sharing facility may utilize acontextual sharing policy that determines sharing privileges for anindividual, group, enterprise, collaboration, private vs. public data,and the like, where the environmentally determined sharing privilegesmay be tied to an access-control facility, such as described herein.

Study Space and Electronic Investigator Site Files (eISF)

In embodiments, the present invention may enable uses and applicationsand may be deployed in environments and systems related to clinicaltrial management, safety document exchange, and collaboration for lifesciences, pharmaceutical, biotechnology, and related industries. Forinstance, a clinical trial management facility may be provided, wherespecialized documentation management control for clinical trails may beenabled in the secure collaborative environment, such as providedthrough the intermediary use of the secure server of the presentinvention, such as to safeguard critical information, reduce costs, andstreamline operations, as well as for secure exchange of informationboth inside and outside of the network and firewall of a particularuser, such as a pharmaceutical company, a regulatory body, or the like.Further, the use of functionally integrated user interfaces withexisting user applications may promote adoption of new site users thathave traditionally employed paper-based documents in clinical studies,as well as help maintain existing site users where administrativeburdens placed on sites due to a paper-based process has been shown tocause a high turnover of investigators. The clinical trial managementfacility may provide a convenient, secure way to manage criticalinformation during clinical trials, such as in support of bringing newdrugs and therapies to market, where automated workflows help to movecritical documents from one phase to the next, easing the flow ofinformation between organizations and saving time. In addition, auditand reporting capabilities may be provided to support transparency andcompliance, which leads to faster approvals by regulatory agencies.

The distribution and collection of documents during initiation of aclinical trial has traditionally been a highly manual, time consumingprocess, prone to risk. The challenge grows with the additionaldimensions of multiple sites and multiple simultaneous studies. Theclinical trial management facility provides a secure, online repositorythat can ease the study start up process, enabling centralizedcollaboration for documents and communication. On an industry-widebasis, clinical trials often fall behind their timelines from the verybeginning, such as during protocol development, site selection, studystart-up, and the like. Keeping track of a growing number of studystart-up documents across multiple studies, with many, sometimes eventhousands of clinical sites, while ensuring the most recent versions,presents a challenge to sponsors, researchers, and site investigators.The clinical trial management facility may provide solutions for issuesfacing clinical trial study management through high site-usability todrive adoption, rigorous role-based controls on document access,comprehensive compliance reporting, and the like.

The clinical trial management facility helps improve operationalefficiency, reduce cost, and shorten document review cycles involved inclinical trials, such as by supporting the creation of secureinvestigator portals. The clinical trial management facility enablesusers to better manage the distribution, collection, and tracking ofcritical information, such as related to site recruitment, siteactivation, safety, and the like, while also adding a layer of security.The clinical trial management facility improves communication,collaboration, and document exchange between users involved in aclinical trial, from study team personnel and clinical researchorganizations to investigative sites and institutional review boards(IRBs). For instance, managing the distribution and collection offeasibility surveys online in a secure, centralized location may shortenthe site recruitment process. The status of site surveys may be moreeasily tracked so users can follow-up and get sites on-boarded quickly.Regulatory documents, such as study protocols, may be more easilydistributed and collected. Studies may be more easily kept on track,such as through real-time visibility into user accesses and reviews ofcontent, and to better ensure follow-up action is taken. Investigatorsites may be provided with a personalized view of tasks, requests, duedates, and the like, for easy study management. Reminders and alerts maybe sent when documents are due, or ready for review. In addition, theclinical trial management facility may better ensure that sensitivepatient information is secure, and can't be shared with unauthorizedparties, such as with role-based permissioning and digital rightsmanagement (also referred to as information rights management).

The growth in global site participation has added complexity to theprocess of clinical trial management. Delays in reporting can impactboth patient safety and institutional/corporate reputations, includingsafety document distribution to investigator sites, IRBs, and clinicalresearch organizations (CROs). Additionally, the expanding number ofsubjects enrolled in development programs has increased the level ofcomplexity of effectively managing the process. The clinical trialmanagement facility may provide for investigators to securely submitreports to sponsors in real-time, speeding information exchange andcollaboration when serious events occur, decrease the time needed toreceive and disseminate severe adverse effect (SAE) reports, ensuresecure communication, provide automatic notification of reports andreceipt, help ensure documents are reviewed in a timely fashion, and thelike. In addition, sponsors of widely dispersed global trials usingmultinational CROs may track document distribution with full audittrails, and ensure regulatory compliance across multiple jurisdictions.The clinical trial management facility may enable workflows in supportof collaboration, such as by automatically routing SAE reports forinternal review; provide automated distribution of complete SAE reportsto investigators, IRBs, and CROs; provide audit reports that maintainrecords of report distribution, recipient delivery status, documentaccess, and timing to improve compliance; provide a centralized,repeatable, scalable platform for managing SAEs; provideinterconnections to safety systems that facilitate the seamless routingof SAEs to the sponsor's review team for evaluation; and the like.

The clinical trial management facility may improve efficiency andeffectiveness of the different phases of a clinical trial, such as studystart-up and site activation, study conduct and site monitoring, safetydocumentation distribution, management of trial master files andinvestigator site files, and the like.

Site selection is the process of identifying a sufficient number of andgood-quality investigators to conduct the trial. This is one of thegreatest challenges in clinical trial execution. Trial managers need tofind individuals with considerable medical skills, commitment toresearch, good facilities, willingness to support documentationrequirements, access to patients who fit the patient selection standardand will agree to enroll, and the like. The clinical trial managementfacility may improve this process through enabling centralization ofmanagement (e.g., single ID and password access to clinical trialdocuments), standardization (e.g., standardization of templates,document formats and naming), automation of the process (e.g., studystart-up packages automatically distributed), monitoring of the trial(e.g., clinical trial lead and project leads able to view the status ofeach site, number of outstanding tasks), collaboration (e.g., sitespecific tasks enabling a clinical study associate to have guidedcollaboration with investigator sites), and the like.

Once an investigator site has been activated for a clinical trial, theinvestigator enrolls patients and monitors the study, including ensuringthat the staff is well versed with the trial's documentation (e.g., theprotocol, informed consent forms, safety guidelines, case report forms),managing the product and drug inventory, scheduling patient visits,gathering data, reporting adverse events, and the like. The clinicaltrial management facility may improve this process through providingsecure mobile platform facilities (e.g., mobile access to documentationassociated with investigator sites), centralized management of sitedocuments, permission access control (e.g., quickly verify if aninvestigator site has access to the latest study documents, and if not,grant them access and notify them via email), and the like.

While conducting the clinical trial at investigator sites, patients mayexperience side effects or adverse events (AE or adverse change inpatient health) while the patient is receiving the treatment. AEs mustbe reported by the investigator site to IRB/EC and sponsor/CRO. Theclinical trial management facility may improve this process throughcentralized management of safety documentation and distribution (e.g.,each exchange represents a study that may be organized into acollection, such as studies organized by product or compound, allowingstudy teams to focus on their study and specific sites, while the safetyteam distributes safety reports across study), safety report automation(safety reports automatically distributed to the appropriate sites, suchas when an investigator site from a specific country is activated, andusers are automatically granted access to relevant safety reports thatwere distributed prior to their activation), visibility (e.g., a usermay quickly identify that the distribution of a safety report wassuccessful, where the advance report provides information such as whensafety report was distributed, when investigator site was alerted, ifalert was sent successfully or if it was sent back, and if sent back,what was the reason for the return), and the like.

At the start of the trial, a trial master file (TMF) must be establishedat the sponsor organization and at each investigator site. The TMF isnormally composed of a sponsor file, held by the sponsor organization,and an investigator site file (ISF), held by the investigator. Thesefiles together are regarded as comprising the entire TMF for the trialand should be established at the beginning of the trial. In most casesit is essential to segregate those documents that are generated or heldby the sponsor of the trial from those of the investigator. Thisrequirement is firstly due to subject confidentiality issues, forexample, the sponsor must not have documents such as consent forms andsubject identification lists if the subject has not specificallyconsented to them holding this information. Secondly, where theinvestigator site file contains source documents, the case report forms(CRFs) contain source data or the CRFs are the investigator'sindependent copy of the transcribed data, providing this to the sponsorwould remove the investigator's control.

Filing essential documents at sites in a timely manner can greatlyassist in the successful management of a trial by the investigator,sponsor and monitor. Trial master files should be established at thebeginning of the trial, both at the investigator/institution's site andat the sponsor's office. A final close-out of a trial can only be donewhen the monitor has reviewed both investigator/institution and sponsorfiles and confirmed that all necessary documents are in the appropriatefiles. The clinical trial management facility may provide for anelectronic trial master file (eTMF), electronic investigator site file(eISF), and the like, where a clinical trial management facility'ssecure collaborative environment may not only improve the efficiency ofthe clinical trial, but also decrease the risks endemic in a paper-basedsystem (e.g., it has been found that more than 20% of the issuesidentified by sponsors refer to document control). In addition,providing site-controlled eISFs, private documents for sponsors and forinvestigator sites may be kept separate though a secure integratedsystem, and where all documents may then be archived at the end of thetrial.

Just as a site's data validates or invalidates the study hypothesis, thedocumentation validates or invalidates the data. Regulatorydocumentation at least in part contributes to validation of the data.From this documentation, monitors and inspectors may assess many aspectsof investigator and sponsor responsibilities and the conduct of thestudy, including the non-bias of the investigators, training andqualifications of study staff, appropriate recruitment and enrollment ofstudy participants, adequate accountability of the test article,adequate oversight by a principal investigator, and the like.

Data that cannot be validated cannot be used to answer the studyquestion. The only way for an outside person (such as a sponsor monitor,auditor, or FDA inspector) to assess the quality of the study and itsresults is through the site's documentation. A complete investigationalsite file provides documentation to support that the investigatoradhered to their responsibilities under jurisdictional laws andinternational guidance for conduct of human subject research. Anup-to-date eISF facilitates the effective and efficient management ofstudies, and helps decrease procedural errors. Investigator sites mustmaintain full control over their eISF without the sponsor ever havinguncontrolled access, even decades after the completion of the study. Thesponsor is responsible for ensuring agreements are in place for thelong-term storage whilst always meeting this key requirement.Investigator site files may have the requirement to be reviewed by thesponsor's monitors, as they are responsible for maintaining an adequatelevel of oversight.

The site investigator or site coordinator is responsible for storing andorganizing of all essential study documents and correspondence, such asentering adverse event information into a safety database; following-upwith the investigator site for additional information or clarification;support the review, generation, and distribution of the safety report;and the like. A monitor or clinical research associate (CRA) may spend amajority of time traveling to investigator sites. They have to know allaspects of the clinical trial and any other instruction orclarifications that have been communicated to the site by the in-houseteam (e.g., clinical study associate), and needs to ensure that theinvestigator site is complying with protocol, that the latest form (e.g.informed consent form) is being used, review the investigator site filefor completeness and accuracy, review the status of the investigatorsite with the IRB, and the like.

The clinical trial management facility may improve the process ofmaintaining a clinical trial's TMF and site's ISF by proving centralizedelectronic management through the eTMF and site ISFs through the secureserver. For instance, through filing and managing of essential documentsin the electronic investigator-controlled site file (eISF), includingthrough easy-to-use desktop integrated browsing of the electronicinvestigator site file, integrating the process by saving a documentinto the appropriate investigator site file sub-folder on the exchange,being able to scan a document directly into an investigator site file,and the like. Remote monitoring of the eISF may be provided through asecure mobile interface, secure desktop interface, and/or secure webinterface, where monitors may be provided secure and controlled accessto their investigator site clinical documents, remote and immediateaccess to navigate the latest site-based documents, secure granting ofaccess to sensitive site documents (e.g., tighter than available whenthe ISF is in a paper form), and the like. Using a single ID andpassword, both clinical study associate and investigator sites may haveaccess to a central area that contains their clinical trials, such asthose for the sites that have other sponsors. By using standardtemplates, folder structure and document naming convention across allstudies, site teams may be able to establish a common framework and aconsistent approach to eliminate confusion and enable automation.

Benefits of the clinical trial management facility, through use of eTMFsand eISFs include the ability for sponsors to maintain synchronizationwith the eTMF and eISFs, all documents being provided online for siteinvestigators, reduction of storage costs for archiving, improvedfacility for site monitoring (e.g., remote review of CRAs, controlledaccess to documents, perfection of documents for site visits, statusreports derived from e-reports), improved facility for auditors andinspectors (e.g., user-friendly user interface, automated summary andcompleteness reports, direct access to previous versions of documents),and the like.

Secure Enterprise Content Portal

Enterprise sharing of confidential documents comprises a significantactivity within certain business sectors, such as in finance, legal,governmental, and the like. The secure sharing of ‘sworn documents’ (or‘formal,’ ‘affirmed,’ ‘notarized,’ or any other types of ‘official’documents, whether or not they are ‘sworn’) is especially a concern,where sworn documents may be sworn signed documents in a financialtransaction, a sworn declaration in a legal proceeding, an affidavit,and the like. As part of a business transaction the enterprise may needto share a sworn document with an outside counsel or with partners, suchas part of a financial or legal transaction, where it is essential thatsecurity and confidentiality be maintained. Direct access to sworndocuments is also risky, as any alteration to the sworn document couldaffect its validity as a legally binding document. In addition, suchdocuments may contain personal or confidential information that needs tobe securely maintained. Thus it is essential that the process of sharingsworn documents be secure, auditable, and confidential.

A secure enterprise content portal, such as portal 255 of FIG. 2A, maybe provided as a service to an enterprise as a collaborative portal fortransporting and distributing content between an enterprise and externalentities (e.g., law firms and partners). The secure enterprise contentportal may reduce regulatory risk to the enterprise as associated withsworn documents, be able to allocate functionality associated with sworndocuments back to individual business units within the enterprise,manage third-party professionals separately from core enterprise systemsto provide for a quicker on-boarding processes while lowering securityrisks, and the like.

Referring to FIG. 45, the secure enterprise content portal may providefor a stateless bi-directional closed loop document transport cache asan intermediary transport mechanism between an enterprise data storagefacility for the storage of sworn documents and a third party. Thesecure enterprise content portal may be provided as a stateless processin order to establish the portal as a transport mechanism, withoutrequiring that it become a source system of record. Traceability ismaintained through the transport process, but the design of the systemmay be such that the portal is not considered a legal repository for thedocument, but only a mechanism for providing secure sharing accessbetween the enterprise and the third party. As such, the secureenterprise content portal is also bi-directional and closed-loop, wherethe system acts as a machine process that progresses through the sameclosed-loop sequence for each retrieval-sharing-return process of thesworn document. For example, and referring to FIG. 45, in a first step(1) the sharing process is initiated at the enterprise with the transferof the sworn document from a document tracker database. In a second step(2) the sworn documents are transferred along with provisioning detailsfrom the document tracker database. In a third step (3), and alsoreferring to FIG. 46, the sworn documents are uploaded to a securesharing facility where permissioning is assigned for third party access.In a forth step (4) a collaborative environment is established betweenthe secure sharing facility and the third party using the establishedaccess permissions. At this point, the third party may access thedocument as determined in the access permissions (e.g., view, copy,edit, print). In a fifth step (5), and also referring to FIG. 47, thesworn document is extracted and downloaded along with metadata from thesecure sharing facility back to the document tracker database. Thismachine process acts as a secure cache, providing a temporary dataholding between the enterprise document tracker database and the thirdparty that maintains a secure and auditable access facility for thethird-party that is isolated from any direct interface with theenterprise document tracker database. Once the sworn document istransferred back to the document tracker database, there may be no traceof the document left within the secure sharing facility. In embodiments,one exception to this may be a document audit history being retained,such as for a period of time, until a verification step is completed inassociation with the document being stored within the document trackerdatabase.

The secure enterprise content portal thus provides a secure mechanismfor a third party to access a sworn document stored with an enterprise,such that the sworn document is only indirectly accessed through theportal so that there is no risk to the source document stored in theenterprise database. The portal provides a stateless machine processthat does not need to constitute a source system of record, but itprovides a mechanism for executing permissions to third-parties at leastin part through metadata stored with the document in the enterprisedatabase, secures confidentiality of the sworn document throughimplementation of the portal as a machine transport process, and thelike.

Managing Access to Content Through Digital Rights Management

Digital content sharing is a convenient and easy way to exchangeinformation between people, organizations, companies, or any otherentities. However, sharing content over digital media, such as theInternet, may expose the content to untrusted users. Many digital rightsmanagement (DRM) technologies provide solutions to limit access toshared content to trusted users.

A typical digital rights management (DRM) system includes arights-issuer configured to create and provide access policies, orpermissions, associated with corresponding content items, and a DRMengine that typically encrypts content items and manages users andaccess policies. The typical DRM system also includes DRM clients, oragents, for enforcing access policies, associated with content items,within a client device. Within each DRM system, the corresponding rightsissuer, DRM engine, and DRM agents are expected to comply withproprietary, or standardized, specification requirements that arespecific to the DRM system. As such, DRM systems employing distinct DRMtechnologies are not interoperable.

Also, once access policies are provided to a DRM client device,management of the access policies is handled by the DRM engine.Dynamically modifying the rights policies once they are delivered to aclient device is either impossible, or calls for an active role by therights issuer to synchronize with the DRM engine and/or the DRM agentsin order to revoke previous access policies and provide new ones.

In embodiments, a DRM system may be provided with a middle layerenabling support of, and interoperability between, different DRMtechnologies presented by applicants. In the embodiment DRM system, DRMengines do not perform encryption, user management, nor access policies'management. Each time a protected content item is opened on a clientdevice, corresponding access policies are requested from a correspondingDRM engine. The DRM engine forwards the request to a content protectionserver. The content protection server retrieves the access policies fromthe rights issuer, and provides the retrieved access policies to the DRMengine in a format readable by the DRM engine. The access policies arethen provided to the DRM client, or agent, to be enforced in the clientdevice. As such, the rights issuer is enabled to dynamically modifyaccess policies at any time. At each attempt to access the content item,the most recent access policies are retrieved from the rights issuer andenforced at the client device.

According to at least one example embodiment, a method and correspondingcontent protection server for managing access to electronic contentcomprises retrieving access policies, or permissions, associated with acontent item from a corresponding content sharing application, or rightsissuer. The access policies are translated into a format recognizable bya digital rights management (DRM) engine, and forwarded to the DRMengine. The translated access policies are then provided by the DRMengine to a client device where the translated access policies areenforced in managing any potential access to the content item.

In order to retrieve the access policies, the content protection serverreceives information identifying the content item from the clientdevice. The content server then requests from the corresponding contentsharing application, or rights issuer, the access policies associatedwith the content item based on the received information identifying thecontent item. In response to the request, the rights issuer, or thecontent sharing application, sends the requested access policies to thecontent protection server.

Retrieving the access policies includes receiving the access policies ina format recognizable by the content protection server. The accesspolicies are translated into the format recognizable by the contentprotection server by an interface associated with the content sharingapplication, or rights issuer. The access policies in the formatrecognizable by the content protection server are then translated, bythe content protection server, into a format readable, or recognizable,by the DRM engine.

Prior to retrieving the access policies, the content protection serverreceives, from the DRM engine, user credentials for authentication. Thecontent protection server may handle the authentication of usercredentials locally. Alternatively, the content protection serverforwards the user credentials to the content sharing application forauthentication. Once user credentials are successfully authenticated,the content protection server receives information identifying thecontent item. The content sharing application, or system, is identifiedbased on the received information identifying the content item.

Also, prior to retrieving the access policies, the content item isencrypted by the content protection server. Encrypting the content itemincludes receiving the content item from the content sharingapplication. An encryption protocol is then determined based on a typeof the received content item. The received content item may bepreprocessed based on the content item format. The content item is thenencrypted based on the determined encryption protocol. The content itemmay further be post-processed based on the content item format. Theencrypted content item is provided to the user/client device. Thecontent protection server also causes the encrypted content item to beregistered at the DRM engine.

The access policies are dynamic. That is, on a subsequent attempt toaccess the content item at the user device, the access policies areautomatically retrieved again from the content sharing application,translated and provided to the DRM engine by the content protectionserver. So, any modification of the access policies by the contentsharing application, or rights issuer, is included in the accesspolicies retrieved by the content protection server upon a subsequentattempt to access the content item.

According to at least one example implementation, the content protectionserver is coupled to two or more DRM engines. The content protectionserver is also coupled to two or more content sharing applications, orsystems.

Digital rights management (DRM) technologies provide solutions forsecure content sharing, electronic content protection, and user accesscontrol to electronic content. With such solutions, an entity may beable to manage who has the right to access content circulated over theInternet or other digital media, and what kind of rights are granted toeach potential user. Electronic content herein refers to one or moremedia objects, such as, music files, images, video files, textdocuments, or the like.

In a typical DRM system, a rights issuer issues access rights, orpermissions, associated with a content item, or object, and provides theaccess rights to a user device. The DRM rights are enforced at thereceiving user device through a DRM client, or agent. A DRM enginecoupled to the DRM clients is configured to encrypt content items andmanage users and access policies. Each DRM engine typically hasproprietary, or standardized, architecture, protocols, encryptionmethods, policy management and processing methods. The corresponding DRMagents and rights issuer are expected to be compliant with thespecificities of the DRM engine and the DRM technology employed by theDRM system in general. As such, DRM system employing distinct DRMtechnologies are not interoperable. In order for a user device toconsume protected content by a given DRM system, the user device isexpected to have a complying DRM agent.

Some typical DRM systems do not enable dynamic access policies, and, assuch, access policies may not be modified once they are distributed toDRM agents. Other DRM systems require synchronization between the rightsissuer and the DRM engine.

FIG. 35 is a block diagram illustrating a digital rights management(DRM), or Information Rights Management (IRM), system 100B, according toat least one example embodiment. The DRM system 100B includes a contentsharing system, or application, 110B, a content protection server 150B,one or more rights management services (RMS), servers, also known as DRMengines, e.g., 160-1B-160-nB, and a content rendering system, orapplication, 180B. The content sharing system 110B is configured toshare content 115B with client users. Specifically, the content sharingsystem is configured to circulate protected content 185B to user/clientdevices 180B through the content protection server 150B and a RMSserver, or a DRM engine, e.g., 160-1B, 160-2B, . . . , or 160-nB.

The content sharing system, or application, 110B is configured to act asa content issuer and a rights issuer. For example, the content sharingsystem 110B includes a content issuer module 112B and a rights issuermodule 118B. The content issuer module 112B is configured to circulatecontent 115B over the Internet, or any other communications medium, forsharing with potential users. The rights issuer module 118B isconfigured to issue permissions, or access rights, in association withcontent 115B for sharing by the content issuer module 112B with clientusers. The content issuer module 112B may include, or be coupled to, acontent repository containing content 115B for sharing. The contentissuer module 112B and the rights issuer module 118B may reside on thesame device, e.g., enterprise server, personal computer, or the like, oron different devices.

According to at least one example embodiment, the content protectionserver 150B is coupled to one or more content sharing systems 110B andone or more RMS servers, or DRM engines, e.g., 160-1B-160-nB. Thecontent protection server 150B represents an intermediate layer, betweenthe DRM engines 160-1B-160-nB and the content sharing system(s) 110B,that is agnostic to the DRM engines 160-1B-160-nB and the contentsharing system(s) 110B. The middle layer is configured to normalizecontent processing, irrespective of the content type, and handle contentencryption instead of the DRM engines 160-1B-160-nB. Specifically,during a publishing phase, the content protection server 150B isconfigured to encrypt the content 115B, irrespective of thecorresponding content type, and provide a corresponding protected, orencrypted, copy 185B of the content to the content sharing system 110B.The content sharing system 110B may then share the encrypted content185B with client users.

Also, when the client user attempts to access the encrypted content185B, the content protection server 150 acts as an inter-operabilitylayer between a RMS server, or a DRM engine, e.g., 160-1B, 160-2B, . . ., or 160-nB, and the content sharing system 110B associated with theprotected content 185B. In other words, during a consumption phase ofthe protected content 185B, the content protection server 150Btranslates policy objects received from the content sharing system 110B,or the rights issuer module 118B, into a format, or language,recognizable by the DRM engine, e.g., 160-1B, 160-2B, . . . , or 160-nB.

According to at least one example embodiment, the content protectionserver 150B provides an interoperability interface between fundamentallydifferent DRM technologies, at the protection layer. That is, the formatand/or language employed in creating the access rights, or permissions,by the rights issuer 118B and the DRM technologies supported by a givenDRM engine may be fundamentally different and non-compliant to eachother's requirements, yet, the content protection server 150B providesan interface that enables interoperability between the given contentsharing system 110B and a given DRM engine.

The content protection server 150B is configured to support multiple DRMtechnologies and corresponding DRM engines 160-1B-160-nB. For example,the RMS servers, or DRM engines, 160-1B-160-nB include a “LiveCycle”server from Adobe, a Microsoft RMS server, and/or other proprietary orstandardized DRM engines. The content protection server 150B is alsoconfigured to support multiple content sharing systems 110B.

According to at least one example embodiment, the DRM engines160-1B-160-nB are used to register documents and reroute access requestsfrom client devices to the content protection server 150B. The DRMengines 160-1B-160-nB do not perform content encryption, usermanagement, nor policy management. However, the content protectionserver 150B may employ software development kits (SDKs) to match theparticular DRM technology for that DRM engine. Encryption is done at thecontent protection server side, yet the employed encryption techniquesare expected to be compliant with the techniques supported by the DRMengines. When a client user attempts to open the protected content 185B,the user device 180B sends a request for corresponding DRM policies, orpermissions, is sent to a corresponding DRM engine. The DRM engineforwards the request to the content protection server 150B, whichrequests the DRM policies, or permissions, from the content sharingsystem 110B, e.g., from the policy issuer 118B. Upon receiving therequested access policies, the content server 150B provides the accesspolicies to the DRM engine, which provides them to the user device to beenforced. In response to each subsequent attempt to open the contentitem again, the same process is repeated and access policies areobtained again from the content sharing application 110B, or the rightsissuer 118B. Such scheme enables the content sharing application 110B,or the rights issuer 118B to dynamically manage and control the accesspolicies with the certainty that the latest updated version of theaccess policies is employed by a user device attempting to access thecontent item. For example, the content sharing application 110B, orrights issuer 118B, may update access policies associated with contentitems once the content items and the corresponding policies have beendistributed. The access to already distributed content items may also berevoked by the content sharing application 110B, or rights issuer 118B.

FIG. 36 is a signaling flowchart illustrating communications betweendifferent entities of the DRM system 100B during a publishing phase,according to at least one example embodiment. The publishing phaserefers to the protection and circulation, or sharing, of a content item.Upon initiating a process of sharing a content item 115B, at 205B, thecontent item is sent 210B to the content protection server 150B.Initiating the process of sharing, or circulating, a content itemincludes, for example, attempting to attach the content item to anemail, attempting to upload or send the content item to a non-securedevice, or the like. The content protection server 150B determines anencryption protocol based on the type and/or format of the content item.For example, for a Microsoft Office document, the content protectionserver selects an encryption protocol that is supported by Microsoftrights management services (MS RMS). However, for a PDF document, thecontent protection server selects an encryption protocol that issupported by Adobe LiveCycle RMS. The content item 115B is thenencrypted according to the determined encryption protocol by the contentprotection server 150B at 215B. The content protection server causes theencrypted content item 185B to be registered at a corresponding DRMengine at 220B. For example, if the content item 115B is a MicrosoftOffice document, then the corresponding DRM engine is a Microsoft RMSserver. If the content item 115B is a PDF document, then thecorresponding DRM engine is an Adobe RMS server. According to exampleimplementation, the content protection server 150B sends a publishinglicense identification (ID) and information indicative of existenceaccess policies associated with content item to the DRM engine forregistering the content item. At 230B, the encrypted content item 185Bis sent to the content sharing application 110B. At 240B, the contentsharing application 110B, or the content issuer 112B, shares theencrypted content item 185B with one or more user device 180B. Forexample, the content sharing application 110B may send the encryptedcontent item 185B to the one or more user devices 180B. The contentsharing application 110B may, alternatively, make the encrypted contentitem 185B available to the one or more user devices 180B, for example,by uploading the encrypted content item 185B on the Internet.

FIG. 37 is a signaling flowchart illustrating communications betweendifferent entities of the DRM system during a consumption phase,according to at least one example embodiment. Once the encrypted contentitem 185B is opened, at 305B, in the user device 180B, informationidentifying the encrypted content item 185B is sent at 310B to acorresponding DRM engine 160B. In this case, the corresponding DRMengine 160B may be determined based on a rendering application used toopen the encrypted content item 185B or DRM agent associated with theencrypted content item 185B. For example, Microsoft Office willautomatically contact a MS RMS server. The corresponding DRM engine 160Bresponds to the user 180B, at 320B, with authentication information thatis determined, for example, based on the information identifying theencrypted content item 185B. The authentication information indicateswhat kind of authentication is required for the encrypted document item185B.

At 325B, the user device 180B provides an authentication window orsession for the user, and the user is requested to enter his usercredentials. The user credentials are then sent to the contentprotection server 150B for authentication. According to one exampleimplementation, the content protection server 150B may handle theauthentication locally if, for example, the content protection server150B maintains a database of authentic user credentials for each user.Alternatively, the user credentials received by the content protectionserver are sent to the content sharing application 110B forauthentication. Once user credentials are authenticated, an indicationof successful authentication is sent to the user device 180B. Once theuser credentials are authenticated at 325B, the user device 180B sends,at 330B, the information identifying the encrypted content item 185B tothe DRM engine 160B again. The user device 180B may also send anotification to the DRM engine 160B indicating that user credentials aresuccessfully authenticated.

At 340B, the DRM engine 160B forwards the information identifying theencrypted content item 185B to the content protection server 150B. Thecontent protection server 150B sends a request, at 350B, to the contentsharing application 110B requesting access policies, or permissions,based on the information identifying the encrypted content item 185B.The content protection server 150B stores, for example, a databasemapping information identifying content items to corresponding contentsharing applications 110B, rights issuers, or corresponding plug-inmodules 120B. At 355B the plugin module 120B translates the requestedaccess policies into a format, or language, recognizable by the contentprotection server 150B, and the translated access policies are sent at360B to content protection server 150B. Alternatively, the translationto a format, or language, recognizable by the content protection server150B may be performed by a translation module within, or associatedwith, the content protection server 150B.

The plug-in module 120B resides at the content sharing application 110B.The plug-in module 120B is implemented, for example, as an applicationon top, a plug-in, an extension of the content sharing application 110B,or the like. The plug-in module 120B translates 355B permissions, or DRMpolicies, specific to the content sharing application 110B, or thecorresponding rights issuer 118B, into a format, or language,recognizable by the content protection server 150B. The contentprotection server 150B stores information that enables mapping theencrypted content item 185B to a corresponding content sharingapplication 110B, or plug-in module 120B. Upon receiving permissions fora specific document, the plug-in module may be able to identify whatcontent sharing application or plug-in to call for the specific documentin the authorization phase.

The content protection server 150B translates, at 365B, the accesspolicies into a format, or language, recognizable by the DRM engine160B, and sends 370B the access policies in the format, or language,recognizable by the DRM engine 160B to the DRM engine 160B. The DRMengine forwards 380B the access policies received to the user device180B. The access policies are enforced 385B in the user device 180B, forexample, by a corresponding DRM agent.

The process described with respect to FIG. 37 is performed again witheach subsequent attempt to access the encrypted content item 185B in theuser device 180B, and each time, the latest version of the accesspolicies is obtained from the content sharing application and enforcedat the user device 180B, therefore enabling dynamic access policies thatare managed by the content sharing application 110B, or the rightsissuer.

The content protection server 150B includes a set of applicationprogramming interfaces (APIs), which provide to third parties a publicinterface for accessing functionalities associated with the contentprotection server. Such APIs include analytics APIs, policy managementAPIs, document management APIs, and user management APIs. Analytics APIsprovide third parties with access to a set of functions that upon use bya developer of a content sharing application 110B return a set of datawhich represents the information that a user device conveyed to a DRMsystem regarding usage of a content item. Policy management APIs providea third party with access to a set of functions that enables thedeveloper of a content sharing application to manage local policies oraccess rights. Document management APIs provide access to a third partyto a set of functions that enables a developer of a content sharingapplication through a customization module to encrypt content items. Theuser management APIs provide access to the a third party to a set offunctions that helps a developer of a content sharing application toimplement functionality related to managing users in a DRM system 100B.

The content protection server 150B has queuing services built-in thatenable processing one or more content items, received for encryption,asynchronously and in a scalable fashion. The content protection server150B also provides encryption services including algorithms and DRMspecific protocols for encrypting content items received by the contentprotection server 150B. The content protection server 150B is alsoconfigured to process documents. Specifically, the content protectionserver 150B is configured to provide logic and algorithms to pre-processor post-process content items that are received by the contentprotection server 150B before or after encryption. According to at leastone example embodiment, the content protection server 150B is a computercloud server. Alternatively, the content protection server 150B is acomputer server residing on the same network as the content sharingapplication 110B. According to yet another example embodiment, somemodules of the content protection server, e.g., an encryption module forperforming encryption, is implemented within the same computer networkas the content sharing application 110B, while other modules areimplemented on a cloud computer server.

In embodiments, a method of managing access to electronic content maycomprise retrieving, by a content protection server, access rightsassociated with a content item from a corresponding content sharingapplication; translating the access rights retrieved into a digitalrights management (DRM) format recognizable by a DRM engine; andforwarding, to the DRM engine, the translated access rights, thetranslated access rights being provided by the DRM engine to a userdevice and employed by the user device to provide access to the contentitem. Retrieving the access rights may include receiving informationidentifying the content item from the user device; requesting, from thecorresponding content sharing application, the access rights associatedwith the content item based on the received information identifying thecontent item; and receiving the access rights requested. The determiningof the corresponding content sharing application may be based oninformation accessible to the content protection server, the informationmapping the information identifying the content item to thecorresponding content sharing application. Translating the access rightsretrieved into a DRM format that may be recognizable by the DRM enginemay include, for example, first translating the access rights retrievedinto a format associated with the content protection server, and thentranslating the first translated access rights in the format associatedwith the content protection server into the DRM format recognizable bythe DRM engine. An instance of user credentials may be received, and thereceived instance of user credentials may be authenticated based onstored information indicative of corresponding authentic user. Aninstance of user credentials may be received, and the received instanceof user credentials forwarded to the content sharing application forauthentication. The access rights may be managed dynamically by thecontent sharing application. The content protection server may be acloud server. The content protection server may reside in the samenetwork as the content sharing application. The content item may beencrypted, and the encrypted content item may be provided to the userdevice prior to retrieving the access rights. Encrypting the contentitem may include receiving the content item from the content sharingapplication, determining an encryption protocol based on a type of thereceived content item, pre-processing the content item by employing oneor more predetermined logic based on the content item format encryptingthe content item based on the determined encryption protocol,post-processing the content item by employing one or more predeterminedlogic based on the content item format, and the like. The content itemmay be registered within the DRM engine. In embodiments, an apparatusfor managing access to electronic content may comprise a processor and amemory with computer code instructions stored thereon, the processor andthe memory, with the computer code instructions stored thereon, beingconfigured to retrieve access rights associated with a content item froma corresponding content sharing application, translate the access rightsretrieved into a digital rights management (DRM) format recognizable bya DRM engine, and forward, to the DRM engine, the translated accessrights, the translated access rights being provided by the DRM engine toa user device and employed by the content rendering system to provideaccess to the content item. In retrieving the access rights, theprocessor and the memory, with the computer code instructions storedthereon, may be configured to receive information identifying thecontent item from the content rendering system; to request, from thecorresponding content sharing application, the access rights associatedwith the content item based on the received information identifying thecontent item; and to receive the access rights requested. In retrievingthe access rights, the processor and the memory, with the computer codeinstructions stored thereon, may be configured to determine thecorresponding content sharing application based on informationaccessible to the content protection server, the information mapping theinformation identifying the content item to the corresponding contentsharing application. In translating the access rights into the DRMformat recognizable by the DRM engine, the processor and the memory,with the computer code instructions stored thereon, may be configured tofirst translate the access rights retrieved into a format associatedwith the apparatus, and translating the first translated access rightsin the format associated with the apparatus into the DRM formatrecognizable by the DRM engine.

The access rights may be dynamically managed by a rights issuer moduleassociated with the content sharing application. The apparatus may be acloud server. The apparatus may reside in a same network as the contentsharing application. The processor and the memory, with the computercode instructions stored thereon, may be configured to encrypt thecontent item, and provide the content item encrypted to the user deviceprior to retrieving the access rights. The processor and the memory,with the computer code instructions stored thereon, may be configured toreceive the content item from the content sharing application, determinean encryption protocol based on a type of the received content item, andencrypt the content item based on the determined encryption protocol.The processor and the memory, with the computer code instructions storedthereon, may be configured to cause the encrypted content item to beregistered at the DRM engine. The apparatus may be coupled to two ormore DRM engines. The apparatus may be able to be coupled with two ormore user devices or content applications.

Dynamic Entitlement Management

In embodiments, a dynamic entitlement management facility 239 mayprovide greater control over end-point or recipient content accessthrough a community of users, work-stream, domain, geography, such asthrough digital rights management (DRM) contextual control orinformation rights management (IRM). IRM may be used herein as analternative wherever DRM is used. Contextual content management andcollaboration may be managed for communications, coordination, andcollaboration of content, context, and community. For instance,contextual control may be managed for communications comprising contententitlement, distribution, collection in the context of real-timecommunications (e.g., instant messaging), notifications, activitystreams, tagging of content, and the like, for a contact, network ofusers, subscribed set of users (e.g., blogs, news), and the like.Contextual coordination management may involve content with respect towork-streams, work-flows, approvals, compliance in the context ofcalendars, action items, dashboards, archiving, retention, compliancewithin directories, groups, memberships, and the like. Contextualcollaboration management may comprise content with respect to editing,redlining, annotation in the context of group calendars, team wikis,meeting management, within portals, discussion boards, expert networks,dashboards, analytics, and the like. Collaboration, coordination, andcommunication may be managed with respect to the context of contentusage amongst a select number of users or within a community. Inembodiments, dynamic entitlement permissioning may be based on groupsthat are dynamically created to assign rights, where groups may crossorganizational boundaries, where assignments are based on collaborationrelationships that are not stable, and the like, where group enablementis made to be dynamic to changing conditions.

The dynamic entitlement management facility may utilize an enterprisepolicy to override a user's personal DRM-based entitlement permissions(e.g., access, sync, share, and the like). For example, an enterprisepolicy may dynamically override a user's entitlement permissions toensure intellectual property protection/leakage protection, where theuser is dealing with content in an enterprise context. At the same time,the enterprise is dealing with the content context of a user'sentitlements. The organization's policy on people, context, and contentmay be enabled to override the individual user's choices, such as basedon geographic location, location context, network conditions,collaboration connectivity, and the like. For instance, a user may havepersonal-level of permission to access a document because they are theowner of the document, but the enterprise may deem through a policyfacility that the user should not be able to access the document withinthe context of their current location (e.g., foreign country, competitorenterprise location, public network, and the like). In embodiments,dynamic entitlement may be determined based upon dynamic risk-rated DRMprotection, where the system assigns a dynamic risk rating (DRR) to auser, and based on that DRR, apply dynamic DRM protection controls. Forinstance, a DRR may be assigned to a user when they login, sign-in,authenticate, and the like, and may change as conditions associated withthe user change. The level of control applied to a document (even if theperson is the owner of the document), may be based on their current riskprofile as determined by the assigned DRR. For example, the user may bein China, and the system may assign a DRR that only permits a user toaccess documents in a certain format. The DRR may be based on IPaddress, geography, data node factors (e.g., who controls the nodes thatdata has to travel across), type of data, metadata, action the userwishes to take, and the like. In embodiments, there may be a matrix ofDRR states, such as where the DRM is based on a current DRR. Inembodiments, DRR may be extended beyond document access, such as beingassociated with different features in the system. For example, if auser's risk score is not higher than X, they may not be enabled to starta work-flow, and they might have to go to an organizational leveladministrator to start work-flow if their risk level is high (e.g., dueto being in a risky place, geographically or where the user is on thenetwork). The DRR may have a classification such as highly sensitive,low sensitivity, and the like. A DRR risk score for a document may bebased on the content, based on who handles it, key words, presence ofCVV or SSN numbers, document type, document metadata, size of document,presence of types of information (e.g., code, and the like).

In embodiments, dynamic entitlement may involve extending a user'spersonal DRM-based entitlement permissions (e.g., access, sync, share,and the like). For example, an enterprise policy may dynamically extendor open up a user's permissions to a set of DRM documents within acomputing environment, such as based on a policy, a user's profile(e.g., a user's position in the company, a user's access level, a user'swork group or division, or the like), a user operating criteria (e.g.,automatically providing access to DRM documents based on the userworking in a secure computing environment), and the like. Extending auser's DRM-based entitlement permissions may relate to DRM documentsthat the user has permission to access or to DRM documents that they donot have explicit permission to access. For example, a user may normallyhave to provide authentication each time they access a new DRM document.However, the dynamic entitlement management facility may provide, suchas through a policy and after a single authentication, automatic accessto all documents the user has DRM permission to access within apredefined computing environment. For instance, the user may be providedpermissions to all DRM documents to which the user has DRM, such assaved on the user's hard drive, while the user is in communication withthe dynamic entitlement management facility; to all DRM documents theuser has DRM access to that are stored within an enterprise networkwhile the user is behind the enterprise's firewall; and the like. Inthis way, the user may be saved from having to provide authenticationfor each document they have DRM permission to access while the user iswithin a policy-determined secure computing environment. In anotherexample, the dynamic entitlement management facility may extend a user'sDRM permissions beyond the permissions explicitly determined in the DRMpermissions of a document. For instance, the DRM permissions of adocument may explicitly specify one or more users with permissionsassociated with access to the document, and upon authentication, thoseusers are able to access, edit, print, and the like, the document.However, the DRM permissions may also provide for a policy-determinedaccess by users other than those with explicit permissions. Forinstance, the CEO of a corporation may have global permissions to accessa DRM document, an engineer of an enterprise may have permission to openany of a class of DRM protected technical documents, an employee of anenterprise may have permission to open any of a class of DRM protecteddocuments created by the enterprise while the user is inside theenterprise network firewall, and the like. In this way, an enterprisemay specify extended permissions for DRM protected documents toaccommodate specific needs for document access.

Access to a DRM-protected document may require a user to authenticate.Authentication has traditionally been provided at the document level,where a user would need to authenticate for each document the useraccesses. In addition, DRM-protected documents downloaded from a remotelocation, such as from the secure server of the present invention, mayhave required the user to authenticate twice, once on the remotelocation to gain access to download the document, and once on the user'slocal computer storage to access the downloaded document. Although theDRM protection may offer needed security, the user experience can becomeburdensome with regard to this need to continually authenticate on adocument-by-document basis. In embodiments, a DRM authentication servicemay be provided to keep a user authenticated as long as a set ofauthentication conditions, or ‘context’, are maintained. Context mayinvolve the user maintaining an active session with the service, theuser remaining in a particular computer environment (e.g., uniquelylogged into their machine), and the like. One of the ways the DRMauthentication service may provide this continued authentication is byloading a unique machine registration token onto the user's computerenvironment (e.g., a combination of computer hardware and operatingsystem), thus allowing the DRM authentication service to see that theuser is working from a computer environment that has been verified. Aslong as the user maintains these conditions, the user may seamlesslynavigate amongst documents to which they have DRM permission to access.For instance, a user may log into the service at the beginning of theirday from their personal computing device, authenticate for a firstaccess to a first DRM document, and then, as long as the authenticationconditions don't change (that is, as long as the user is still loggedinto the same device), the user maintains the ability to access thisdocument a second time, to access any other DRM document for which theuser has rights to access, download a DRM document from the secureserver to their local machine and open the document, and the like,without re-authenticating. Thus, in this example, as long as a user islogged into the DRM authentication service, such as located on thesecure server, the calls made by application DRM agents to the DRMauthentication service are validated by the document application (e.g.,Microsoft Office, Adobe Reader).

In embodiments, the information provided in an authentication contextmay include a machine registration. For instance, the first time a useraccesses a protected document on a given machine a machine ID may begenerated and stored on the physical machine. The association betweenmachine ID and the user ID may be stored with the DRM authorizationservice (e.g., on the secure server) for validation of futureauthentication requests. The machine ID is unique, such as tied to thecombination of a physical machine and OS user login. For example, in thecase of two different users sharing the same physical machine but eachlogging in with his/her own username/password, there will be twodistinct machine IDs issued to the two users. The same user logging intotwo different machines with the same credentials will have two distinctmachine IDs. The machine is ID persistent, survives machine restarts,upgrades, and is not easily removed from a machine. With the machine IDincluded in an authentication context, the DRM protection is maintainedeven when one physical machine is used by a number of different users.In embodiments, other ID capabilities may be utilized, such as throughthe user of biometric identifiers.

In embodiments, the DRM authentication service may provide a user withaccess to DRM protected documents without having to explicitly providetheir credentials in an authentication as long as it can be validatedthat they have maintained an active session with the DRM authenticationservice. Authentication may be required only at the start of an activesession, such as with the first requested access to a DRM protecteddocument. At the time of this first user authentication, the DRMauthentication service may store a context for the authentication thatis used to authenticate future access requests by the user. For example,a user may request access to a document stored on the secure server, anddownload the document to the user's local disk. Recall that in pastsystems the user would have had to authenticate at the time of accessfor the download as well as when they subsequently open the document ontheir local disk. However, the DRM authentication service utilizescontext from the first access to authenticate the second access. Forinstance, at the time of download, a ‘context 1’ may be recorded as arecord of the context of the access, such as including a download ID,timestamp, client IP, user ID, token, and the like. The downloadeddocument may be encrypted and have the download ID embedded in it. Theuser then opens the document through the document's source application,which makes a call to the DRM authentication service to authenticate andauthorize access. The DRM authentication service may then generate a‘context 2’ for this second access request, such as including a downloadid, timestamp, machine id, client IP, user id, and the like. With theinformation from ‘context 1’ and ‘context 2’, the system is able tovalidate the second access if the conditions for access have notchanged. For instance, if the information from ‘context 1’ is consistentwith the information from ‘context 2’, the second access is granted.However, if when the DRM authentication service finds a difference, orfinds no record of a ‘context 1’, then the user would be prompted toprovide authentication. In embodiments, once the second context,‘context 2’, has been utilized to access the document, one of the‘context 1’ and ‘context 2’ may be invalidated or deleted so that thereis only one current context for future access authentications. Forexample, the ‘context 1’ may be invalidated for subsequent accessauthentications once the ‘context 2’ information is obtained, where‘context 2’ is then used for a next access request. This non-limitingexample is meant to be illustrative of the system's process, but oneskilled in the art will appreciate that other access scenarios may alsobe accommodated. For instance, the example describes a scenario wherethe user downloads and accesses a protected document on their localdisk, but the system may similarly enable a user to access a secondprotected document on their local disk, a second protected documentstored on the secure server, a protected document received from anotheruser, and the like. As long as the context established in a previousaccess authentication matches the context for a current access request(e.g., the user is still logged onto the DRM authentication service, theID for the user matches, the ID for the machine matches), the currentaccess request may be granted without the user being prompted forauthentication. FIGS. 48A-B provide a DRM authentication service flowdiagram with three illustrative access request scenarios in relation touse of the DRM authentication service after a document has been DRMprotected, including interactions between the user, the secure server,encryption process, a services API, the DRM authentication service.Scenario 1 is where the user is making a first access request under aset of contextual conditions, such as in the first access request in asession with the DRM authentication service; scenario 2 is where theuser is making an access request in an active session; and scenario 3 iswhere the user is making an access request in a non-active session.FIGS. 49A-B, 50, 51A-B, and 52 provide alternate DRM authenticationservice flow diagrams, where the document is a PDF document.

In embodiments, DRM protection in combination with dynamic/adaptivemulti-factor authentication may be provided through a browser view of aprotected file. For instance, a user may restrict access by providing asecond user only a portion of a file, rather than the whole file, basedon the second user's risk level. Alternatively, a user may provide asecond user with extended permissions, such as based on the seconduser's profile (e.g., the CEO of the company), geographic location(e.g., the second user is inside the firewall of their enterprise),secure network connection (e.g., inside the enterprise firewall), andthe like. In embodiments, DRM protection may be used to restrict orextend DRM protection through policy, user profiles, a current state ofa user, and the like.

In embodiments, the dynamic entitlement management facility may includea document destruction and retention policy, where DRM policies areutilized for archiving and destruction of documents. For instance,information is stored with DRM, so that the file will expire based onits DRM when the time is right, without further action, so thatself-destruction of the document is based on DRM. This self-destructionDRM mechanism may be able to be overridden. A user may be able to set upan auto-reminder to the central storage location to confirm that thedestruction policy has been carried out, is still valid (e.g., notsuspended by a litigation order), has been overridden, an the like. Inembodiments, a corporate record, such as recorded in metadata with thedocument, may be kept with a document, such as where the corporaterecord includes a history, annotations, and the like, of the document,e.g., who looked at the document, under what conditions the document hasbeen viewed, who has set or altered a self-destruct parameter, the datefor self destruction, and the like. In embodiments, the annotationsand/or history of a document may be separately protected. For instance,there may be one DRM protection assigned to the document and anotherassigned to the information stored in a related file or as metadataattached to the file, such that a user may be able to access thedocument but not the information, or be able to access the informationbut not the document. In this way, an enterprise would be able to assignpermissions based on a need to know, where an administrator, forinstance, may be permitted to view metadata for a document but not thecontent of the document, and a user or editor of the document may beable to view the content of the document but not be permitted to viewthe metadata for the document.

In embodiments, the dynamic entitlement management facility may beimplemented on a secure server remote from an enterprise, in the cloud,local to the enterprise (e.g., inside the enterprise firewall), on auser's computing device, through a web browser, and the like.Implementation of the dynamic entitlement management facility may notrequire the use of a plug-in, such as by extending native APIs extendedto provide DRM on content. The dynamic entitlement facility may beimplemented without any plug-ins, agents, or any other additionalsoftware installation on the client making, end user device, and thelike. For instance, in a traditional DRM configuration, a client deviceattempting to open a DRM document may have to access services (e.g. forencryption, authentication, active directory) in order to gainpermission to open the document, such as through utilization of aplug-in for that specific DRM technology. The dynamic entitlementmanagement facility may comprise DRM services internal to the secureserver configuration such that the user's client device does not have toaccess any external services, such as for encryption, authentication,permissions, and the like. For example, once the user is logged into thesystem, the user may not have to authenticate again when the want toopen a DRM document because the system already knows the user'spermissions (e.g., through a one-time token, password, and the like).

In embodiments, the dynamic entitlement management facility may enablean offline mode while allowing a user to work in a protected environment(e.g., online and offline modes while in a protected mode). The dynamicentitlement management facility may provide for group level policycontrol with policy set ranking, external share restrictions, devicelocation restrictions, policies that permit sharing by device, access toapproved domains to restrict browser and kiosk asks, secure shared linkpolicies, password, password strength, link expiration, mobile data planpolicies, mobile editing policies, restricted third-party applications,mobile sync controls, automated deletion, file control policies, and thelike.

Key Management in a Secure Content Environment

In embodiments, a secure managed key facility may be provided formanaging the use of encryption keys, such as for managed content sharingbetween users in a secure sharing and un-sharing facility, managingaccess to content through digital rights management, content sharingamongst users in a customizable secure exchange platform (e.g., exchangeof content between data nodes), sharing data across heterogeneouscontent repositories in a federated access environment, and the like,such as described in this disclosure. Encryption keys may utilizesymmetric-key algorithms (e.g., use of the same key for both encryptionand decryption), asymmetric-key algorithms (e.g., public-private keyusage, with a public key for encryption and a private key fordecryption), and the like, to provide secure communications andencrypted content files between users and systems. FIG. 53 depicts afunctional flow diagram of an embodiment for the secure managed keyfacility 5302, involving managing key usage between two user clients,where in this embodiment one user is a sender client 5304 and the otheruser is the receiver client 5306 of a content file 5308. Both users, inaddition to the sender communicating the content file to the receiver,also communicate with the secure managed key facility as part of asecure management protocol, which in turn communicates with a key store5310.

The secure management protocol may involve the exchange of variouscertificates between the secure managed key facility and the users. Forinstance, the secure management key facility may provide accountcertificates, licensor certificates, user licenses, and the like, to theusers as part of the process of securely exchanging documents betweenusers, as well as utilizing different encryption key algorithms used inthe communications and encryption of information and content files. Forexample, the sender client 5304 may request to the secure managed keyfacility 5302 to send a document securely to the receiver client 5306.The secure managed key facility may then send both the sender client andthe receiver client various certificates that enable or validate thesecure communication of the file content from the sender client to thereceiver client. Amongst the certificates to the sender client thesecure managed key facility may provide the sender client with a contentkey for encrypting the content file for transmission to the receiverclient. The sender client may then use the content key to encrypt thecontent file and transmit it to the receiver client. In addition, thesender may provide an access policy with the encrypted content file,which the receiver client must comply with in order to be granted accessto the content file. The access policy may be a digital rightsmanagement access policy, such as described in this disclosure.

One aspect of the secure management protocol is the management of thecontent key. For instance, one possible method for management of thecontent key is to provide the content key to the sender client, have thesender client encrypt the content file with the content key, and sendthe receiver client the encrypted content file along with the contentkey, such as where communications are encrypted with a public key. Inaddition, the communication may also include an access policy selectedby the sending client. The receiving client receives the encryptedcontent file, encrypted with the content key. The receiver client maythen communicate with the secure managed key facility (e.g., thereceiver client providing the secure managed key facility with theencrypted content key and access policy) to determine whether it has theright to access the content file, and if access is granted, such as perthe access policy, the secure managed key facility may then provide thereceiver client with a decryption key. However, this process involvestransferring the content key amongst the various parties and thusexposes the content key to unauthorized capture (e.g., through computerhacking) Further, if the content key is used for multiple documentexchanges, multiple clients, and such, then the unauthorized capture ofthe content key potentially places many communications at risk.

In an alternate protocol, reducing the extent to which the content keyis exposed to other parties, especially the receiving client, may betterprotect the content key against unauthorized capture and subsequenthacking. In embodiments, the content key may be generated by the securemanaged key facility, such as when the sending client requests a securetransfer, and is stored in the key store along with a content keyreference. The secure managed key facility then sends the content keyand the content key reference to the sender client, which then encryptsthe content file as in the first example. However, this time the senderclient does not transmit the content key to the receiver user, butrather transmits the content key reference to the receiver user. Inembodiments, the sender client may then discard the content key. Thereceiving user may then communicate with the secure managed key facilityfor access as before, but with the content key reference rather then thecontent key itself. The secure managed key facility may then use thecontent key reference to retrieve the content key from the key store,and provide the receiver user with a decryption key if access ispermitted. Thus, by transferring a content key reference in the contentfile exchange, the content key is more secure, creating a more securecontent exchange environment. In embodiments, encrypted communicationsbetween the secure managed key facility and the sender and receiverclients may be encrypted with a key (e.g., a public key) provided by thesecure managed key facility.

Various rights management services exist, implemented to manage theexchange and uses of rights-protected content that is distributedthrough computer networks, such as the types of content shared in theenvironments described throughout this disclosure. An example, used inconnection with servers that employ the Windows® operating system,relates to Active Directory Rights Management Services (AD RMS, or RMS).Components of computer networks that employ RMS have trusted connectionsamong each other that are implemented by a set of certificates.Enforcing the validity of these certificates is a core function of RMStechnology. Each item of rights-protected content, such as a file asender wishes to share with a receiver, is published, along with alicense that expresses the conditions that apply to the use of thecontent. Each consumer of the content receives a form of license thatreads, interprets, and enforces the usage rules. Thus, a given type oflicense corresponds to a particular type of certificate. License rightscan be expressed in computer-readable forms, such as expressed in amark-up language, such as eXtensible rights Markup Language (XrML). Thecertificates and licenses used in RMS may be connected in a hierarchy,so that a client can parse a chain from a particular certificate orlicense through a series of trusted certificates, arriving at a trustedkey pair.

One type of certificate is the server licensor certificate (SLC), whichtypically contains a unique public key that corresponds to a server (ora cluster of servers that operate as a single logical server). In theexample of AD RMS, the SLC is created when the AD RMS server isconfigured (or the first server in a cluster). The server generates aunique SLC for itself that establishes its identity (referred to in somecases as self-enrollment). The public key is provided for long-termvalidity, such as two hundred fifty years, so that rights-protectedcontent can be archived for long durations. In embodiments, a rootcluster handles both certification, by issuing a rights accountcertificate (RAC), and licensing of rights-protected content. Otherservers added to the given root cluster may share an SLC. In complexenvironments, licensing-only clusters can be deployed, each of whichgenerates an SLC. Thus, a fundamental characteristic of conventionalimplementation of RMS is that each entity that interacts with the RMSsystem is represented by a single, specific certificate.

SLC certificates use the eXtensible Rights Markup Language (XrML) ratherthan a more standard form of certificate, which allows SLC certificatesto express complex lists of RMS access rights. The SLC is a self-signedcertificate, and the private key corresponding to this certificate isused by the RMS server to protect other certificates used in the RMSsystem. The public key in this certificate is then typically used by RMSclients to encrypt materials that only the RMS server can decrypt.Client machines have an RMS machine certificate (sometimes referred toas a Security Processor—SPC). The SPC is used to authenticate eachmachine to the RMS system and allows machines to encrypt otherRMS-related data that's stored locally on the computer.

Another aspect of the secure management protocol involves the use of anasymmetric public-private key pair to encrypt communications and contentbetween different parties, such as provided in connection with at leastone of the certificates, such as SLC certificates, issued in the securemanagement protocol. For instance, the secure managed key facility,after it determines that the receiver user has permission to access thecontent file, may send the receiver user the decryption key to decryptthe content file, encrypted with the public key associated with the SLCcertificate containing the public key issued by the server that iscapable of decrypting the content file. However, if the same public keyis used for all of the communications for a plurality of users of agiven server, there is a risk that an unauthorized user may obtain thekey and hack it, such as using brute force decryption methods, thuscompromising the security of all content for the plurality of users thatis secured by that particular server or cluster of servers. Animprovement to the protocol can be made to increase the security of thecertificate of a given server (typically the SLC certificate) bysplitting the certificate of a given server or cluster into multiplevirtual certificates. Since a certificate is comprised of a certificatechain (containing the public key and the expression of the rightsmanagement rules and licenses for the content in question), acertificate, with a different pair of public-private keys, may begenerated on a per user basis (e.g., a particular company, individual orgroup), even if there are different users that use the server or clusterto secure content. Therefore all the operations that the particularvirtual certificate was used for will be used with a specific user pairof public/private keys. If a given user's public-private key iscompromised, only the documents that were generated for that user willbe compromised, thus not affecting other documents generated from thatserver or cluster within the secure managed key facility. The virtualcertificates containing pairs of public/private keys for a given serveror cluster may be stored independently in a different storage systemaccording to the user's security requirements. In addition, hardwaresecurity module solutions could be used in conjunction for increasedconfidentiality.

Customer Managed Keys (CMK)

Customer managed keys (CMK) may provide the ability for customers tocontrol their own data encryption keys (i.e. for data at rest), such asprovided by inserting an additional step in the basic encryptionprocess, such as shown in FIG. 39. In this way both the system-providedkeys and the customer keys are needed in order to access the data, suchthat neither can do it alone. An example sequence of the encryptionprocessing may include the steps of generating random data key and keyID per file, encrypting file with the data key, encrypting the data keywith a customer key, and encrypting the data key with a system masterkey, where the encrypted data key and key ID are stored in a database.Customers may be provided a partition of keys, such as through ahardware security module that safeguards and manages digital keys forstrong authentication and provides crypto-processing. These modulestraditionally come in the form of a plug-in card or an external devicethat is separate from and attaches directly to a computer or networkserver. Customer keys may be partitioned such that users on the secureserver side may be able to access the partition (e.g., to identify towhat parties sets of keys have been provided), but such that the userson the secure server side are not able to see the actual keys. Thecustomer may be able to access the partition through an external device,such as a USB key into a laptop, encrypt with the customer's key, thenencrypt with the secure server master key, thus creating adouble-encrypted key at their own site. Customers may be able togenerate a new key on demand, supply an existing key, rotate a key,disable a key, manage multiple keys per organization, per businessgroup, and the like. Key management, such as in key-based serviceversions, helps keep distributed attacks from succeeding. For instance,when a new key is introduced into services, the older keys may be suchthat they no longer work, so even if there is an attacker in the system,it can't use the same keys for repeated attacks. As a further protectionof the customer's keys, unencrypted or decrypted keys may be storedapart from the secure server or orchestration services layer, such asonly with the customer on their enterprise premises or network, such asin a data node controlled by the customer, and the like. As such, theunencrypted or decrypted keys are prevented from being compromised fromthe orchestration server side and remain in control with the customer.

In embodiments, a CMK implementation may use a data key to encryptcontent that is separate from the master encryption key and alsoseparate from the customer encryption key. This separation has a numberof advantages. By having a data key that is used to encrypt the files inthe file processing servers, the system is able to apply significantprocessing power to the encryption and decryption of files, (e.g.,outside of the hardware security module (HSM)) in order to achieve highthroughput. The HSM encryption processing may be limited to encryptingand decrypting the data key, which may be done by passing the data key(e.g., a very small number of bytes when compared to MB/GB/TB of contentfiles) into the HSM and requesting it to encrypt or decrypt the datakey. The HSM then returns the result, which the system is then able touse to encrypt or decrypt the actual content files. By having thecustomer key stored inside the HSM and restricting system access to thatkey to only use the key within the HSM, the system provides customersfull control over whether their content can be decrypted or not withoutthe system ever having access to the customer key. This approach hasbenefits during key rotation because customers are able to define a “newkey” while their “old key” is still active. During the key rotationprocess, the system keeps track of which key was used to encrypt eachunique data key using a “key ID” for reference. When a user requestsviewing a file, the system looks to see which customer key (old or new)was used to encrypt the data key and asks the HSM module to use that keyto decrypt the data key so the system can then decrypt the file. Onceall the data keys have been rotated (decrypted with the old key andre-encrypted with the new key), the customer can tell the HSM to deletethe old key, and the rotation process is complete without the systemevery having access to either the old or new key, and without the systemever being required to deny access to the files. Service providers whodo not have unique data keys per file, and instead encrypt and decryptfiles directly within the HSM server, would be limited by how much datathey can process at any given time (throughput of HSM being defined bythe rate at which files can be encrypted/decrypted). Since the systemdata keys are small, such as just a few hundred bytes each, the systemmay be able to process all data keys for a customer's entire service ina very short period of time (e.g., tens of minutes). Without this systemin place, a system would potentially need weeks/months to do the same,or be limited to other key rotation processes, such as requiring the oldkeys to stay in service as long as the files need to be accessed.

Referring to FIG. 40, a process for encryption processing with acustomer key is shown, where a CMK service is inserted between thesecure server and the customer HSM devices. Here, a user is shownuploading a file to the secure server, which encrypts and stores thefile with an automatically generated data key. A request is then made tothe CMK service for the data key to be encrypted with the customer key.The CMK service then sends the data key, key ID, and the use user to theHSM to be encrypted by the customer key. In embodiments, a “use user”may be provided to serve in a special role that can request the HSM toencrypt and decrypt data. However, the use user may be bared from anyactivity related to managing the encryption keys (e.g. view, disable,delete, or create), but they are able to ask the HSM to use a key basedon the key ID the system passes in. In an example, each customerpartition may have two types of users: (1) a Partition Owner who managesthe keys (i.e. the customer) and (2) a use user who is able to call theHSM and have processing done for it without actually having access tothe key values.

Continuing to refer to FIG. 40, the HSM then encrypts the data key withthe customer key using the key ID and use user provided, which is thenpassed back to the secure server where the encrypted data key isencrypted with the master key. The doubly encrypted data key and contentfile are then stored, and the unencrypted data key from memory isdestroyed. FIG. 41 shows a top-level diagram of how a customer hasdirect access to manage their keys, where a user uploads and downloadscontent files and client services turns on CMK for the user. Inaddition, professional services may be used to configure the system,where a customer key manager may create, disable, and enable keysdirectly through the HSM.

In embodiments, customer managed keys may be assigned at any level ofgranularity, such as at the organization level, per business group, atan exchange level, per content item, and the like, providing the highestlevel of possible control, and yielding the smallest possible exposureif any one key is compromised. In this way the secure exchange mayprovide customers with multiple-level CMK protection in order to preventanyone from improperly accessing documents stored within the secureexchange environment. For example, a law firm utilizing the secureexchange may have many clients, each with many cases. Within each casethere may be different aspects that need to be separately protected,specific documents that are particularly sensitive, and the like.Granular control of CMK enables the law firm to apply individual CMK toeach of their clients, for each case within a client, to groups ofdocuments, to collaborative exchanges, to individual documents (e.g.,word processing documents, spreadsheets) or content items (e.g., photos,audio files). In another example, multiple organizational entities,acting in a collaborative relationship and sharing content through thesecure exchange may implement levels of CMK control that not onlyincludes granular control within each of their organizations, but forshared content, again at any level of granularity. For instance, somecontent may be CMK controlled by a first organizational entity, some bya second, and some jointly between the two. In this way organizationsmay utilize CMK to control protection to content from the intermediateentity managing the secure exchange, from other collaborativeorganizations, between departments, and the like, as well as to specificcontent. At all levels of CMK control there may be different individualswith control over keys. CMK may be applied at multiple layers, andamongst different collaborative entities. For instance, a manager of adepartment may have control of keys to content related to theirdepartment, but there may also be a company-wide CMK control over allcompany content, individual CMK control for a specific content item, andthe like. By offering CMK at all levels of organization and content, thesecure exchange maximizes the ability for organizations to protect theircontent against the threat that any one key or group of keys iscompromised. In addition, CMK granularity enables different levels ofaccess protection, providing a means for organizations or individuals toimmediately block access to CMK protected content, acting as a type of‘kill-switch’ or ‘red-button’ to deny access to all content protectedthrough that key at that granular level of protection.

Customer managed keys may provide the ability for customers to controltheir own data encryption keys, where the customer managed keys areprotected through DRM technologies. In addition to system-provided keysand customer keys needed in order to access the data, DRM protection maybe utilized to increase the protection and the access control for keymanagement. For instance, DRM protection for customer managed keys mayprovide access control that is controlled through a listing, a policy,and/or contextually (e.g., the user's location, the security levelprovided by a network connection).

In embodiments, the system may authenticate request messages at theapplication layer using a cryptographically secure keyed hash, such asHMAC-SHA1, which may enable protection from illegitimate requests.

Collaborative Customer Relationship Management

In embodiments, a collaborative customer relationship management (CRM)facility may be used in conjunction with a multi-party collaboration inorder to track contacts and communications of participants. For example,CRM may be used in conjunction with a deal amongst enterprises, such asin putting together a merger, syndicated loan, and the like. A data roomfor a deal normally has all of the relevant documents, with rights andpermissions assigned based on the role of individuals who support thedeal (e.g., an enterprise user 1 can look at IP diligence folder X aspart of Task Y from a due diligence checklist). As described herein, thedata room may carry through a work flow of a deal from stage to stage,so that the documents not only get to the right people, but the wholeprocess moves from stage to stage in an organized way. CRM may beincluded in this process, such as when the deal involves a ‘sales’process or other process that benefits from storing information aboutthe relationships of an entity to another entity, or to the individualswithin the other entity, including tracking the interactions with suchother individuals, the role and status of such other individuals, theopinions or positions of such other individuals, the plans of such otherindividuals, the need of such other individuals, and otherrelationship-relevant or project-relevant information. For example, in abig loan deal, individuals are responsible for filling out tranches ofdebt by getting other individuals to commit to making a portion of theloan. So, within the data room work flow, it may be good to have CRMinformation, such as contact information, but more importantly,information about the ongoing interactions with each contact personinvolved in the piece-by-piece building out of the transaction. (e.g., aCRM system may store information like the fact that “Person A at bank Xis looking to take 20% of loan tranche Y, but he needs to look atdocuments P and Q, then get approval from his boss, Person B” and “Nextsteps include checking in with Person A and Person B”, etc.). The CRMinformation can be consulted to develop an appropriate workflow, and toinitiate a series of actions within an overall collaborative exchangeenvironment that complete the workflow. The CRM facility may trackinteraction characteristics with respect to participants, gaugeparticipant interest, control what content individuals are able to viewand access, record conversations between individuals (e.g.,conversations with potential borrowers and investors in a syndicatedloan deal), and the like. The CRM facility may provide for communicationand collaboration facilities, including live messaging capabilities,such as a secure messaging service, including instant messaging orassociated with commercial instant messaging platforms, and the like.Integration services may be provided that enable users to embedmessaging and directory functionality into third-party applications(e.g., word processing applications, presentation applications,spreadsheet applications, and various enterprise software applications)and workflows (including workflows associated with various functions ofan enterprise, workflows associated with transactions, and variousothers). Messaging facilities may be collaborative, secure, and fullyauditable (e.g., one-on-one, multi-party, blast, chat rooms, and thelike). Control of permissions for communications between individuals maybe controlled through preferences, determined by exchange participation,enabled through contact parameters, and the like.

In embodiments, the CRM facility may provide collaborativeinterconnection with individuals within a marketplace, such as a loanmarketplace, such as in a centralized global network of organizationsand their contacts, including borrowers in need of debt financing (e.g.,credit); banks in need of business (e.g., deals, fees and league tablestatus); investors/lenders in need of debt portfolio growth and/orcorporate relationships; legal counsel in need of business andreputation; sponsors in need of corporate relationships, revenue, andreputation; and the like. Individuals within the marketplace may beprovided contact information, such as the individual's organization role(e.g., borrower, arranger, investor lender, counsel, arranger andlender, bank lender), client relationship, client profile, status (e.g.,active vs. inactive, interested vs. not interested, etc.), hierarchy ofentities, roles and personnel, historical deal association, dealspecific contacts, contact types and roles, and the like. The CRMfacility may provide control facilities for contacts such that users areincentivized to maintain their own profiles and connect with othercommunity members. The CRM facility may provide a secure collaborativeenvironment where community members choose their own privacy settingsand control how they interact and are viewed by others. The CRM facilitymay provide search criteria with respect to contacts within the system,invitation and solicitation features, visibility settings, advanced datamining, and the like, such as based on industry preferences.

IP Address and Domain Rule Based Access Restriction

In embodiments, a secure exchange facility with various features andfunctions described throughout this disclosure may implement accessrules that utilize a combination of IP address, domain name, and thelike, to restrict access to the secure exchange facility, such as wherea business entity restricts access to a specified set of IP addressesassociated with a specified domain name. For instance, an organizationalentity (e.g., a business entity, governmental agency, or the like)utilizing the services of the secure exchange facility may provide alist of acceptable IP addresses for specified network domains that thesecure exchange facility may then use to establish an access restrictionrule. For example, the rule may be applied to ensure that any useraccessing the secure exchange facility using an email address from oneof the domains specified in the rule can only do so if the devicethrough which the user is seeking access is utilizing one of the IPaddresses specified in the rule for that domain. Similarly, a rule maybe applied to ensure that any user accessing the secure exchangefacility utilizing one of the IP addresses specified in the rule must belogging in using an email address that belongs to one of the domainsspecified in the rule for that set of domains, and the like. As aresult, the organizational entity may benefit by restricting a user fromaccessing the secure exchange facility from a personal computer or otherdevice that may be unauthorized or unsecure and downloading confidentialor sensitive work documents. Similarly, such rules may restrict a userfrom accessing the secure exchange facility from their work computer anduploading confidential work documents from their work machine to anaccount that they can later access from a personal computer at home, andthe like. These IP- and domain-based restriction rules may prevent usersfrom sharing confidential work information (including with themselves,such as through alternate accounts) in such a way that the users canfurther share it with someone outside the business who should not haveaccess to the information. For example, this type of IP-based ordomain-based restriction may benefit a wide range of entities that arecharged with avoiding leakage of confidential information, such as largefinancial institutions, secure facilities, government entities, and manyothers. In embodiments, these complementary IP- and/or domain-basedrestriction rules may work in conjunction with the organizationalentity's information technology physical security. For example,companies that leverage a domain plus IP range rule are also likely toturn off their users' ability to plug devices into the USB ports. USBports are one way for users to steal company information, and the IP-and/or domain-based restriction rules compliment the IT process thatrestricts USB stealing by also preventing an Internet-based approach tothe same activity.

API Wrapper

In embodiments, the secure exchange facility may provide applicationprogramming interface (API) functionality, such as to provide variousinterfaces to secure exchange functions, components, modules, services,applications and the like that are accessible to other applicationssimply by calling the appropriate API. API calls may be public orprivate, used internally within the secure exchange facility or providedto outside business entities and users. The system may utilizelanguage-specific APIs, such as a RESTful API, that makes it easier tointegrate into or with various applications. In embodiments, the secureexchange server may provide various building block applicationcomponents that are capable of interfacing through an API of the secureexchange server and through which an outside user may access one or moreof the components, and/or assemble multiple components, to create orenhance a customized application, where the application maintains thesecurity of exchanged information while running the application, orcomponents thereof on the secure exchange platform or other secureserver. Secure exchange services may be capable of using multipleversions of APIs, so that new services can be brought online beforeolder versions of the service are taken offline.

In embodiments, the secure exchange facility may include or be providedwith an associated software development kit (SDK), which may includecomponents, functions, services, or the like that facilitate thedevelopment of applications that integrate with the secure exchangefacility or that take advantage of the aforementioned APIs. In manycases, a developer may wish to have a program simultaneously interactwith more than one API; for example, a developer may want an applicationto retrieve documents or files from various locations or deliverdocuments or files to various locations (e.g., storage locations onpremises, cloud storage locations, and locations on a server of thesecure exchange platform), but each of the various locations may haveits own distinct API or set of APIs that is suitable for enablingcommunication and/or integration with the language(s), application(s),storage type(s), operating system(s), and other aspects of the computingenvironment of that particular location. To enable that capability, thesecure exchange facility, optionally through the SDK, may provide one ormore API wrappers to simplify interfacing with the secure exchangefacility or various components thereof, such as through providing theability to make multiple API calls through a single function of a singlesoftware programming language of a user. A given function in a givenprogramming language may be mapped to various different APIs, so thatthe function is executed across multiple APIs and platform componentsbut requires programming only once, in the native programming languageof the application of the developer. Thus, an API wrapper may provide aninterface for the user of the API wrapper that is less dependent uponthe understanding of the internal workings of the functionality of thesecure exchange facility. For instance, an interface with even onefunctional component within the secure exchange facility may utilizedozens of API calls. An API wrapper may encapsulate all of these APIcalls into software code ready to use (e.g., in Java, C, C++, C#, orPython, and the like). In an example, an API wrapper functiongetDocuments(connection, session, exchange) may wrap API calls to one ormore HTTP APIs, where a program may now retrieve a list of all thedocuments from a particular exchange (e.g., exchange #12345) using avery short code instruction, such as (in a Python example):documentList=getDocuments(connection, session, 12345), instead ofcalling a long, complex URL using an HTTP method, such as a GET methodwith the cookie ssoGlobalSessionID and then parsing an XML result asPython objects, e.g.:

<?xmlversion=“1.0” ?> <documentListResponse> <status> <code>200</code><message>Request completed fine, no errors</message> </status><document> <id>11111</id> <indexNumber>1.1</indexNumber> <name>DocumentName</name> <orderNumber>1</orderNumber><version>ac3478d69a3c81fa62e60f5c3696165a4e5e6ac4</version> <createdBy><firstName>John</firstName> <firstNameSort>John</firstNameSort><lastName>Doe</lastName> <lastNameSort>Doe</lastNameSort><organization>Company Inc.</organization> <organizationSort>CompanyInc.</organizationSort> </createdBy> <createdOn><milliseconds>1354013928000</milliseconds> </createdOn><documentHash>0</documentHash> <extension>.pptx</extension><fileHash>2e45oIO5+lCLXLlvzfHaSt4fNiA=</fileHash><fileSize>1407779</fileSize> <hasNote>F</hasNote><isBusinessProcessEnabled>F</isBusinessProcessEnabled><isDeleted>F</isDeleted> <isFavorite>F</isFavorite><isIrmSecured>T</isIrmSecured> <lastModifiedBy><firstName>John</firstName> <firstNameSort>John</firstNameSort><lastName>Doe</lastName> <lastNameSort>Doe</lastNameSort></lastModifiedBy> <lastModifiedOn><milliseconds>1402990995000</milliseconds> </lastModifiedOn><mimeType>APPLICATION/VND.OPENXMLFORMATS-OFFICEDOCUMENT.PRESENTATIONML.PRESENTATION</mimeType><noteRequired>F</noteRequired> <pageCount>0</pageCount><parentId>222222</parentId> <pdfProtection>NOSAVENOPRINT</pdfProtection><sharedResourceCount>0</sharedResourceCount><sharedResourceId>333333</sharedResourceId> <submittedBy/><submittedOn/> <submitterGroups/> <unread>F</unread><versionNumber>3</versionNumber> <workspaceId>12345</workspaceId><xmlLock> <contentLockStatus>UNLOCKED</contentLockStatus> </xmlLock></document> ... </documentListResponse>

In embodiments, the API wrapper may be made available under an opensource software license or similar licensing arrangement, making iteasier for users to develop interfaces with the secure exchangefacility, thus avoiding the inefficiencies of different users needing tocreate their own translation system, allowing users to contribute to thedevelopment or refinement of new or modified API wrappers, and the like.API wrappers may provide an improved method for integration with thesecure exchange facility functionality, thus avoiding an interface thatmay be otherwise perceived as complex and difficult to use.

End-to-End Encryption

The secure exchange may provide end-to-end encryption as part ofcomputer data content protective services as described herein, such asfor not only protecting content being held at rest within the system,but in the transfer of content from a user client device, through thesecure exchange infrastructure, and out to a receiving user clientdevice. For instance, once a user initiates a file upload to the secureexchange, that computer data content may be encrypted and remainencrypted/protected for the rest of its lifecycle. With reference toFIG. 54, the secure exchange may utilize secure sockets layer (SSL)encryption while the document is in motion from the moment it leaves afirst user client 5404 until it arrives in the secure network. Thesecure exchange may then apply various encryption technologies throughfile processing services 5406, including an optional CMK service asdescribed herein, so that the document remains encrypted even while instorage 5408. Then upon a request by a second user client 5412 todownload the content, file processing services 5410 may decrypt thecontent and transfer the file, such as protected through SSL encryption.In addition, DRM protection, as described herein, may be applied so thatthe document remains encrypted/protected even while stored locally 5414on the second user client 5412, where the computer data content can onlybe opened by communicating back through the exchange system's DRMservice where the user is authenticated and entitlements checked.End-to-end encryption protects a user's computer data content not onlywhile the document is stored within the secure exchange storage 5408,but in transit to, from, and within the secure exchange, and optionallywhile transferred to a second user client 5412 through DRM protectioneven after the content has left the secure exchange and is stored andfurther shared.

Customizable Secure Exchange System

In embodiments, a customizable secure exchange system may be provided,wherein methods, systems, and services described herein in associationwith secure collaboration and sharing may be at least in partmodularized and encapsulated in a secure envelope (e.g., where securityextends beyond the hosted secure server, out into the cloud computingspace, as part of an enterprise computing resource inside the enterprisefirewall, or the like), and provided for use to business entities in alocation other than the secure server, such as on-site at a businessentity, on a secure cloud service, on a commercial cloud service,distributed across a geographic area, in a location local to thebusiness entity, provided through distributed hosting, and the like.This architecture may provide a highly scalable platform upon whichbusiness process applications can be built. Further, the functionalityprovided in secure server hosted embodiments such as describedpreviously herein may be modularized to enable the business entity toselect basic services, building blocks, components, toolkits, and thelike in building their own secure collaboration and sharing facilitythat is built to meet the needs of the business entity, such for aspecific business market the business entity operates in, a project thebusiness entity is working with, a partnered collaboration betweenbusiness entities, and the like.

Referring to FIG. 17, system 1700 may comprise a data managementfacility 1702 and a plurality of data storage nodes 1704, which may bedistributed in various locations. The data management facility 1702 maycomprise one or more secure servers and may implement an orchestrationlayer with various orchestration services, as more fully describedelsewhere in this disclosure. The data management facility 1702 maymanage content sharing between various entities of data that is storedin the plurality of data storage nodes 1704. For example, data may bestored by a user 1706, such as a user associated with a first businessentity. The data management facility 1702 itself may be hosted by aseparate entity than the first business entity, and may include multipleregional data management sites, each serving associated data storagenodes 1704.

The data may include data content and metadata, and the data managementfacility 1702 may only have access to certain metadata relating to thedata content, such as metadata related to managing of the data in theplurality of data storage nodes 1704. As a result, the data managementfacility 1702 may have no access to the data content of the data storedin the data storage nodes 1704. In embodiments, the data storage nodemay be comprised of one or more data storage facilities, such as insidean enterprise firewall 1710 at data storage 1708B, outside theenterprise firewall at data storage 1708A, and the like. Furthermore,the deployment of a data storage node may also be provided inside oroutside an enterprise firewall. When deployed outside the enterprisefirewall, the data storage node may be implemented in a cloud-computingenvironment (e.g., through a secure implementation of a commercialcloud-computing provider). When deployed inside the enterprise firewall,the data storage node may be implemented in either a physicalconfiguration (e.g., as physical storage and logic hardware inside theenterprise) or as a virtualized service (e.g., where the physicalconfiguration is in the cloud-computing environment, but virtualized towithin the enterprise). In either case, the data storage node may becompletely isolated from enterprise systems when deployed on premises.

In embodiments, the user 1706 may select where the data storageassociated with the data storage node 1704 is located, such ason-premise, at a server of the entity hosting the data managementfacility, with a cloud-based storage service, or the like, therebyallowing the user to control where data is stored. The user 1706 mayutilize the secure data exchange system 1700 to share data content withanother user, such as a user 1714 outside the firewall, or with a userof another business entity 1712, and the like.

The data storage nodes 1704 store the data content associated withvarious entities (also referred to herein as customers or businessenterprises) using the secure exchange system 1700, and this datacontent may include various types of content such as original files andrespective metadata, fully processed files and respective metadata,customer compliance data, customer identity information, metadatagenerated that relates to files, folders, or other “collections” ofdata, application related metadata (such as if a customer creates a‘deal’, then various deal related metadata may be stored), indexes onmetadata, and the like.

In embodiments, content stored on the data storage node may beimplemented as object storage, which is a storage architecture thatmanages data as objects as opposed to other storage architectures suchas file systems which manage data as a file hierarchy, and block storagethat manages data as blocks within sectors and tracks. Each object mayinclude data, metadata, a global unique identifier, and the like. Theobject storage systems may enable relatively inexpensive, scalable andself-healing retention of massive amounts of unstructured dataassociated with the data storage node, and provide fine-grained accesscontrol to data stored in the data storage node, where data is exposedand managed as objects instead of files or blocks.

Object storage may enable the creation of redundant, scalable datastorage nodes using clusters of standardized servers to store petabytesof accessible data, thus providing a long-term storage system for largeamounts of static data that can be retrieved, leveraged, updated, andthe like. Object storage may use a distributed architecture with nocentral point of control, providing greater scalability, redundancy, andpermanence. Objects may be written to multiple hardware devices, withsoftware responsible for ensuring data replication and integrity acrossthe cluster. Storage clusters may scale horizontally by adding newstorage units. Should a storage unit fail, the system may work toreplicate its content from other active storage units.

Object storage characteristics may include that all objects stored inobject storage have a URL, are replicated (e.g., x3) in zones (e.g.,defined as a group of drives, a node, a rack, and the like, all objectsmay have their own metadata), interaction may be with the object storagesystem through a RESTful HTTP, object data may be located anywhere within the node structure, data storage may scale by adding additionalstorage units without sacrificing performance, new data storage may beadded to without downtime, failed nodes and disks may be swapped outwithout downtime, the system may run on industry-standard hardware, andthe like.

Object storage may separate metadata from content to support additionalcapabilities, such as additional metadata to captureapplication-specific or user-specific information for better indexingpurposes, additional metadata to support data management policies (e.g.a policy to drive object movement from one storage tier to another),independent scaling of data storage nodes, unified access to data acrossdistributed data storage nodes, centralized management of storage acrossmany individual data storage nodes, optimization of metadata storage(e.g. database or key value storage) vs. data storage (e.g. unstructuredbinary storage), and the like. Storing content and metadata as objectsmay enable the creation, modification, and access of objects andmetadata by using a object storage API, such as implemented as a set ofRepresentational State Transfer (REST) web services. The system mayutilize HTTPS (SSL) protocol to interact with object storage, and usestandard HTTP calls to perform API operations. The system may utilizelanguage-specific APIs, such as a RESTful API, that makes it easier tointegrate into applications. To assert access and change content, thesystem may require a user to identify themselves to object storage byusing an authentication token. To get a token, the user may be requiredto present credentials to an authentication service, where theauthentication service then returns a token and the URL for the access.As an API-accessible storage platform, the system may be integrateddirectly into applications or used for backup, archiving, dataretention, and the like.

In embodiments, the data storage node may include replicated copies ofdata, such as onto other disks and hosts, which may provide resiliencyagainst localized disk and host failures. Further redundancy may beachieved by deploying additional content nodes in geographicallydistributed locations, where the orchestration layer may synchronizedata to these alternate locations. For example, three discrete locationsmay be implemented for data integrity, such as to reduce the riskassociated during recovery time in the case of a complete data centerfailure.

The types of data kept in the orchestration layer at the data managementfacility 1702 may include certain metadata that is relevant to theorchestration of file storage and file sharing services, applicationrelated identifiers, file, folder, or collection identifiers, useridentity information, service monitoring data (such as uptime, serviceperformance and service events), logs indicating history and duration ofaccess to data content, and/or ‘normalized’ records of complianceevents, which are stripped of the content of the data to which each ofthese relate.

As mentioned, the data management facility 1702 may be distributedgeographically, so as to enable regional-specific management of theplurality of data storage environments while enabling a user to securelyaccess only one, or only a particular set, of the plurality of datastorage nodes 1704, where each data storage node is securely isolatedfrom other data storage nodes. Each of these storage nodes may bemanaged by a separate entity.

Each of the plurality of data storage nodes 1704 may be remotelyaccessed by a user through a secure application program interface (API)to the secure data exchange system 1700, where the secure data exchangesystem 1700 may utilize a two-call authorization procedure executedbetween the data management facility and a data storage node 1704 toenable secure access between the user and these data storageenvironments. The secure data exchange system 1700 may be extendable bya user through modularized application functionality such as a libraryof selectable applications to allow an entity to create a secureexchange environment customized to requirements of the entity.

In embodiments, this customizable secure exchange environment may bemade available to a user through an application-programming interface(API) with a secure server. Further, this system may enable a businessentity to share content securely beyond the enterprise firewallboundary, while meeting operational, security, and compliancerequirements of entities including global enterprises and financialinstitutions; enable innovative secure sharing and collaborativedocument-intensive business processes (e.g., an intent-based workstream), deliver a secure customizable user experience that is on parwith consumer-driven (but not limited to consumer experiences) softwareand services; and the like. The customizable secure exchange environmentmay provide a framework so business entities are able to build custombusiness applications that are able to meet the varied time-to-use needsof the business, and which are also scalable to meet varying usagedemands. Business compliance may be provided no matter where the modularfunctionality is located, in order to ensure compliance with thecorresponding governance frameworks of various business entities.Analytics may be provided for compliance, business reporting, marketreporting, and the like. Implementation of the customizable secureexchange environment may provide basic services, infrastructure, andorchestration of services, such that there is isolation of logicfunctions, service facilities, and the like, thus enabling the placementof components of the system outside a secure server while stillmaintaining a secure environment. The data model used in implementationmay be modular, flexible, business-centric, customer configurable,architected for scale, premises-to-cloud (e.g., data, metadata, andprocessing structures implemented to be accommodated in locationsoutside the exchange server or on-premise of the entity storing thedata), highly durable and reliable, highly extensible, and the like,such as with business analytics as a core service.

In embodiments, the customizable secure exchange environment may providefor a secure instant apps library of components for collaboration acrossenterprises, where the library of components comprises building blockfunctionalities that can be assembled to build a custom securecollaboration and sharing facility, such as for use across an API.Through this facility, a user or application team for an entity may beable to build their own secure facilities, applications, capabilities,and the like, to their own needs. For instance, the secure exchangeserver may provide building block application components that arecapable of interfacing through an API of the secure exchange server, andthrough which an outside user may assemble components into a customsecure application, and where the application maintains the security andfunctionality of running the application on the secure server.

In embodiments, the customizable secure exchange environment may allow auser to create a custom application by adding business-specific logic ontop of a standard offering layer, such as including assets, content,policies, relationships, and the like, to produce a custom instantapplication that is customized to their needs, such as accessiblethrough an API to the exchange server.

For example, for a custom application may be created for a productionpart approval process (PPAP) by an automotive industry user. Forexample, the system may be applied to a vendor qualification process. Inthis instance, there may be a set of criteria that qualify a vendor tobe associated with the automotive industry user. In another instance,the system may be applied to a production part approval process. In thisinstance, a manufacturing company may have a part it wants approved,which goes through the PPAP process, where they take the parts tovendors for quoting, and then progress through the approval process,such as including a series of documents, inspections, validation steps,and the like. Exchange of content associated with this process may beinteractive between the automaker, tiered vendors, regulators, and thelike. Traditionally, to accommodate this process, there have been stacksof paper forms that are sold as kits. With the present system, the usermay be able to build the forms into the application process, distributecontent across firewalls according to a work streams, and the like, allcustomized to the needs of a particular situation.

One of the advantages of the customizable secure exchange system may bethe separation of the user interface from the logic from data storecapabilities, enabling external developers to build their own secureexchange facility via an API. Thus, the modularity and customizabilityof the system may be such that a business user may be able to choose toimplement a custom environment at different levels of accommodation andcomplexity, such as a basic service level, a business processapplication level with a limited number of building block functionsimplemented, a business process applications level with partners andfunctional component functions implemented (e.g., where componentsinclude a modular set of building block functions), a business processapplication with partner communities with an application buildingtoolkit (e.g., where the toolkit comprises building blocks, components,or the like). In embodiments, the customizable secure exchangeenvironment may act as a platform from which business users may createscalable solutions to their needs.

Referring to FIG. 18, a generic example for a work stream of a businessentity is presented, where the work stream is shown to comprise content,context, contacts, or the like. Content may comprise lifecycle, tasking,reporting, or the like, such as reporting which provides compliance. Inthis example, lifecycle is shown to comprise different states for whichcontent may be in, tasking is shown to breakdown into sub-tasks, andreporting is shown to comprise compliance reporting.

Referring to FIG. 19, a more specific business process applicationexample of a significant transaction of a business entity is presentedthat requires content sharing between entities, where lifecycle statesof the transaction may comprise a deal evaluation, a preliminary duediligence analysis, a letter of intent, an advanced due diligenceanalysis, a negotiation, a sign and close state, an integration, thelike. Each of these states may then include various content,tasks/sub-tasks, reports, or the like. Dependent upon the needs of thebusiness, the customizable secure exchange environment may be used tocreate a secure exchange for the business that is built with thesecontent, context, and reporting needs in mind.

Referring to FIG. 20, this shows a number of example lifecycleprocesses, and how these processes may be accommodated within a set oftasks/sub-tasks and deliverables. In this instance, the four lifecycleexamples (7 states, 3 states, two states, and four states, as shown) arethen represented by block represented lifecycles in association witheach of the tasks/sub-tasks. Visual attributes may provide the user viaa user interface with status, such as showing a highlighted lifecyclestate highlighted to show percent complete for the tasks, a highlightedstate transition (e.g., and arrow between states) to show a relativestate checking indicator between states, and the like.

Referring to FIG. 21, the system may promote the exposing of content andcontext in user interface components, such as in various graphicalrepresentations of all the active deals in process, such as by type,region, size, lifecycle process state, or the like, where theapplication may be built using user interface building blocks and/orcomponents of the system.

Various configurations for implementations of a business data model andlanguage may be provided. The ability for applications to define theirown business data model (or schema) is enabled using a business languagethat the platform can interpret. The platform itself will enforce thebasics of this language, like cardinality and the valid or invalidconnections between various data model types and relationships.

Referring to FIG. 22, the architecture of an exemplary customizablesecure exchange platform may be described by these main functionalareas: (1) an orchestration layer, and (2) data storage nodes forstorage available to the user, via an application wherein theapplication includes business logic and presentation such as a userinterface for the user/entity. The orchestration layer may provideorchestration services that keep track of and manage everything that isgoing on in the platform, including, without limitation, tracking wherevarious data (also referred to herein as “assets” or “user data”)resides, the extent of access to data, brokering interactions,controlling processing, managing data locations, enforcing entitlements,instrumenting and providing analytics, and the like. The data storagenodes may provide data node services that operate on and store thecustomer or user data in data stores (file systems), store files(content data), store metadata, provide transformations, providecustomer or user analytics, provide searching tools, and the like. Whilethe orchestration services know about everything that is going with theuser data at the data content and/or metadata level, such as all actionsand events that take place with respect to the user data, in embodimentsthe orchestration services don't actually see the data content of theuser data itself.

Referring to FIGS. 23A-B, exemplary platform architecture for thecustomizable secure exchange environment is presented, showing how adata storage environment (or data nodes) may be separated from anorchestration layer. As shown, the data storage node includes variousdata node services such as a data store service, a search service, ananalytics service, a transform/filter service, and/or a service managerservice, along with various business applications, and the like. Theorchestration layer includes orchestration services such as a workflowmanager service, an asset and entitlement service, a paradata collectorservice, an analytics service, an identity service, a composite service,and/or a service manager service, and the like. A messaging service andnotification service acts to link these orchestration services with thedata node. In this example, the data storage node is located on thepremises of an enterprise, such as part of an enterprise data center,although this data node may also be located elsewhere.

Each of the services implemented in this architecture may be enabledwith a ‘provider’ layer that insulates a basic service contract(implemented as an API) from the rest of the services. Each of theservices may be capable of processing multiple versions of its API sothat new services can be brought online before older versions of theservice are taken offline. This enables the system to stay up andrunning without any interruption. Each of the services may be written insuch a way that it can be automatically scaled up and down as requiredbased on the level of performance of that service relative to thecurrent workload needed by that service.

Generally, orchestration services are those services that keep track ofand manage all the user data and processing that is occurring. Inembodiments, a basic messaging system that brokers the communicationamong all the services and between the data nodes and the orchestrationlayer is utilized. For example, an asset and location service may beprovided that is responsible for keeping track of where all the assetsin the system are located and which users (persons, groups, and roles)have access to those services from a basic containment perspective. Whena client (web browser, iOS app, or other type of client) of an entityneeds to access a particular asset or grouping of assets, it firstchecks with the asset location and entitlement service. Upon validating,the user of that client is entitled to the asset from a containmentperspective, the service returns the location of the asset along with atoken (or ticket) that can be used, preferably only for a shortpredetermined time period, to access that asset from particular datanode where that asset is stored.

FIGS. 34A-B are similar to FIGS. 23A-B in many respects, and illustratethat an interface between the orchestration layer and the data storagenodes may include load balancing (e.g., in association with an APIinterface), a messaging service, and the like, where the messagingservice may be provided through multiple message and communication bustechnology depending on the interaction required by the services witheach other. This configuration may also help ensure that avirtualization layer can be implemented in both the orchestration aswell as in the data storage node, where the hardware may be located onthe user's premises.

FIG. 24 shows an example download request process, where a user, via aclient application, clicks a link to download a stored file. A requestfor the file location is then sent to the orchestration services, whichupon validation of an authorized user, responds back to the clientapplication with a location and token for the file (which securelyrepresents the authorized action). The client application then requeststhe file from the data node location, providing the token forauthorization. The data node takes the token and, using a key sharedbetween the data node and orchestration service, re-signs the request,thus re-creating the information presented in the token. If theinformation received in the token from the client application matchesthe information in the newly generated token, then the message isverified, and has not been tampered with. Thus the request from theclient application correctly represents the actions that were authorizedby the orchestration service, verifying for the data node that it canproceed to execute them. Once the data node validates the token, itresponds with sending the file to the client application. This processmay be extended to the fine-grained details of an action. For instance,this process may specify not only access to a file, but also toparticular actions (e.g., ‘GET’ vs. ‘CREATE), and even control of whichfields may or may not be changed, and the like. Therefore the processmay be able to control and verify any level of action, thus preventingany unauthorized action from being executed on a file at a data node,even when control verification is provided in a separate location at anorchestration service location.

Other services may include a notification service, a composite service,an identity service, and the like. The notification service may beresponsible for sending notifications via the appropriate channels(e.g., SMS—short message service, SMTP—simple mail transfer protocol).These services may pull messages from the message queue as appropriateand send them to the intended recipient. The composite service may bewhere application business logic (or common business logic) that needsto run outside the data node is processed. The identity service may beresponsible for validating the identity of each user, providing a basicdirectory (also known as Global User Directory or GUD) of the system.This service may support various federation models in order to supportboth login activities as well as rights management. Functionalitiesaddressed within the identity service may include single sign-on (SSO),exclusive single sign-on (ESSO), lightweight directory access protocol(LDAP), active directory integration, security assertion markup language(SAML), and the like. With regard to managing identities, a user mayexplicitly opt-in with regard to allowing their identities to be shared,such as providing their personally identifiable information (PII) toother users of the system depending on business need. Users who do notopt-in may not be provided with access to various services. As a generalrule users who opt-in may not have control over the geographicallocations of where their PII is stored (or replicated). For example,there may be specific requirements related to Swiss law that need to betaken into account using some sort of federated active directory thatprevents any Swiss user involved in the banking industry from havingtheir PII leave the Switzerland borders.

A service manager in the orchestration layer may provide basic healthmonitoring of all services (for the orchestration layer and data nodes),provide scaling of services up and down, provide deployment of businessapplications, provide provisioning of data nodes, initiate bulk loadingand archiving, provide data migration tools (for migrating content fromone data node to another data node), provide administration of businessapplications, configure various application and customer serviceextensions (e.g. transforms and filters), and the like. The servicemanager on the orchestration layer may initiate service requests to datanodes for various maintenance functions, such as backup and restore,deploy new versions of a service (or restore an old version), and thelike. The service manager of the data node may carry out these functionsand provide a mechanism for the orchestration layer to get status ofwhether the function was carried out or not. The ability may exist fortenants to be defined in such a way that full administration rights canbe delegated to partners. This concept is referred to herein as a‘limited admin’, where the system ensures that administration of tenantsis based on the ownership of the administration rights for thosetenants. Partners who have been assigned administration ownership of atenant should have the same level of capabilities as a systemadministrator who owns administration capabilities for tenants that areprovisioned. System administrators may not have access to perform anyadministration functions for tenants that are owned by a partner. Thesystem may reserve the right to turn off a partner's ability toprovision or administer accounts, but this does not mean that the systemwill be able to perform the administration once the partner's rightshave been removed.

A workflow manager service may provide processing flow control of workthat occurs in the system when user data (assets) are uploaded anddownloaded from the system. The processing activities that occur duringupload are referred to herein as transforms and the processingactivities that occur during download are referred to herein as filters.These workflows may be configurable at multiple levels, including at theplatform level (system wide across all applications), at the level ofspecific business applications, at the level of specific customers, andthe like. These workflow processes may cause a number of actions tooccur, such as a custom process, blocking further execution of theworkflow, logging that an action occurred, alerting that an actionoccurred, and the like. These workflows may be used by entities such asprofessional services groups or partners to provide application- orcustomer-specific services to be processed (e.g., package best in classDLP (data loss prevention) or PII (personally identifiable information)integrations for customers to use).

FIG. 25 depicts a concept behind the function of these workflows. Forexample, a transform workflow on a data file uploaded by a user mayinclude a virus scan, a conversion to a PDF, various application orcustomer specific transforms, and then the data/file may be published.An example filter workflow for a file being downloaded by a user mayinclude a watermark application, an RMS application, or variousapplication or customer specific filters, and then the file may bedownloaded.

Transform and filter services are those services that perform processingon files as they are uploaded and downloaded (respectively) to a datanode. The processing occurs within the data node and can be configuredusing the workflow management service. The configuration may occur atmultiple levels such as system wide (e.g., platform configured),application specific, client and professional services (e.g., on percustomer basis), partner configured (on per partner application basis),and the like. All files that are uploaded to the system may be requiredto be processed by a virus scanning transform, and it may be requiredthat no files are made available for download until the virus scanninghas completed and the file is determined to be safe. Some documentformats may be converted to a suitable format, such as PDF, forrendering by the viewer facility, for web viewing, and the like, such asfrom word processor formats, presentation formats, and the like.Watermarking may also be provided, which is a filtering process thatoccurs as files are being downloaded. In embodiments, this process maybe provided for files that have been converted to PDF and are beingviewed using the viewer facility only. The watermarking options caninclude username, date and time, name of the document, and the like. Inaddition to the information contained in the watermark, there may bedisplay options that can be configured, such as the location of thewatermark on the page size of the watermark, and the like.

For large files, ‘viewer chunking’ may be implemented in order toincrease the viewer performance in handling the large files. Forinstance, viewer chunking may be implemented such that portions of thefile can be downloaded and viewed without the user waiting for theentire file to be downloaded. There may be both synchronous andasynchronous chunking processes that occur, such as depending on thetiming of the file download request relative to its initial upload.Rights management processing may also be applied (e.g., informationrights management (IRM), digital rights management (DRM), and rightsmanagement service (RMS)), such as based on the type of file beingprocessed and the technology used in the processing, to protect adocument that is downloaded and viewed locally or offline. Otherservices may be provided for files being uploaded, such as full textsearch extraction, optical character recognition (OCR), page counting,and the like. The full text search extraction transform may process thedifferent file types upon upload so that they can be searched, such asfor PDF, Microsoft Office, text, and the like formats. OCR processingmay be provided for documents, such as scanned PDF files, so that filesthat have been scanned into the system are also searchable.

Data node services are those services that process customer data. Theseservices are required to look at customer data and perform logic basedon that data. The data node layer as a collection of services can liveanywhere, including in a public cloud provider, a system data center,on-premises at a customer site, such as via an appliance, virtualmachine, and the like. The purpose behind the deployment options of thecomponents of the data node layer is to accommodate the various customerneeds around data privacy, legal data restrictions, cost, and the like.

Only users with appropriate entitlements are able to access or managethe data content in data storage nodes, such as in an asset data store,a file data store, and the like. An asset data store may be wheremetadata about assets is kept. This metadata may or may not beassociated with specific files. The data contained in the asset datastore can only be accessed by a user with the proper entitlements andonly once the client they are using has presented the data store withthe appropriate token (or ticket). The file data store may be where allfile data for a given data node are stored.

In embodiments, a search facility or search service may be provided,such as to perform a full text search, a metadata search, and the like.A full text search capability may run on the data node and beresponsible for full text searching. The indexing and other processingof file data needed for search may be provided during a transform whenfiles are uploaded. There may also be a need for searching based onmetadata. This searching may also be done on the data node layer becauseit is required to look at the actual contents of stored customer data.

A data node may provide a paradata service, an analytics service, and areporting service, a service manager, a business language, bulk load andarchiving facilities, customer managed keys, and the like. Paradata isthe exhaust data of all the activity that occurs in the system, where adata node paradata service captures the customer-entered data. Thecustomer specific analytics and reporting needs may primarily be met byinteracting with the paradata service on their data node. They may runspecial purpose data extraction programs that provide data they areentitled to access for the purposes of running custom reports. Theservice manager at the data node interacts with the service manager thatis part of the orchestration services. It accepts, acts, and responds tomessages from the orchestration service manager. Business language mayprovide the processing that enables an application to query and traversethe business data model using terminology defined by the application.The bulk load and archive processing may enable exporting and importingdata such that a complete set of customer data can be reconstituted inits entirety including historical information with date and timeinformation. While this service may provide a basic navigation and viewof this information (e.g. via raw XML), any ‘live’ presentation of thisinformation in an offline mode may typically be the responsibility ofthe application responsible for creating and rendering the datainitially.

Infrastructure and management services may be provided that control andhelp manage the rest of the services in the platform. For instance,there may be a component of the management service in the orchestrationlayer and another component of it in each data node. These services mayeach perform local functions as well as communicate to each other inorder to have functions performed on their behalf Some of the operationscarried out by these components may be enabled in an automated way basedon configuration parameters that have been set, and other operationsperformed on-demand through the use of API calls. The ability to deploy,monitor and control both orchestration and data node services maysupport the ability to check on the number of service instances runningat any point in time, the ability to check on the health of any serviceinstance that is running, the ability to bring specific new versions ofa service up, the ability to bring specific old versions of a servicedown (e.g., soft shutdown), the ability to force a specific instance ofa service to shut down (e.g., hard shutdown), auto-scale a service thatis not meeting its service-level agreement (SLA), the ability toconfigure the SLA for a specific service, the ability to identify thephysical resources that are available for resources to pull from, theability for a service to request additional physical resources from apool of resources, the ability to perform backup (and restore)operations, and the like.

In embodiments, the infrastructure and management services may providefor different resource deployments, such as cloud deployment,on-premises deployment, hosted software-as-a-service (SaaS), and thelike, as well as hybrids of the foregoing. Cloud deployment of servicesin a public cloud infrastructure may be supported for services includingthe orchestration and data node architecture components. On-premisesdeployment of data node services may be supported, such as forperforming an automated “self-check” of whether data node resources areaccessible, checking and monitoring the physical resources available ona data node, bringing up a data node, checking on the version of allservices in a data node, bringing up services on a data node, checkingon the health and operations of a data node, checking on the security ofa data node, pushing new versions of any service down to a data node,and the like. There are a number of physical data node classes that maybe supported, such as depending on the level of availability desired bythe customer, including active-active fixed scale, active-active dynamicscale, and the like. Orchestration and data node services may also behosted on the system's secure server.

Referring to FIG. 26, it is shown how this separation of the data nodestructure from the orchestration layer provides flexibility as to wheredata nodes, with their files, metadata, business logic processing, andthe like, may reside, such as on premises with the business entity, as ahosted software as a service (SaaS), stored in the cloud, located indifferent geographic regions, and the like. With this structure, thepresence of a separated orchestration layer in the architecture is notbound to the premises, and enables tracking and reporting of actions onobjects, properties, tasks, work streams, and the like, at a level ofabstraction that does not require access to the underlying data contentitself. For example, the data node may be located in a cloud serviceprovider location and the orchestration layer located on the secureserver of the system. The data, files, lifecycle, tasking, reporting,and the like, may be present in the cloud located data node, where theorchestration layer on the secure server may have connectivity with thedata structure but not knowledge of the data content itself. Forinstance, the data node may contain data as part of the completion of aseries of tasks, and the orchestration layer may know of the hierarchyrelating the data and completion of tasks, but have no knowledge of thesubstance of the tasks (e.g., just that they are 80 tasks that are in ahierarchy and 20 are complete).

Referring to FIG. 27, services provided by the orchestration layer andthe data node may be scalable in order to accommodate different hostedsolutions, where services may be automatically scaled or adjusted up ordown based on actual usage, where analytics in the orchestration layermay provide data that at least in part determines whether to scale up ordown. For instance, as shown in the illustrative example of FIG. 27,there may be a greater need for data storage in the data node servicefor a hosted U.S. data node than for a hosted E.U. data node and stillless for an on-premises data node, where needs for the data store arescalable to the needs of the three sites. In a similar way, the servicesprovided by the orchestration layer may be scalable to the needs ofdifferent business solutions, such as shown where there is much greaterneed for support of collection in the hosted U.S. solution and less inthe hosted E.U. solution. Further, there may be some solutions to whichno orchestration services are provided in some cases, such as anentirely on-premises solution. Each service may have the ability to beconfigured with a specific SLA (service level agreement) threshold andthis threshold will be monitored using paradata so that the service canbe scaled up as needed as long as the physical resources are available.In addition to physical resources being configured from which eachservice may pull, there may also be a non-physical equivalent that isconfigured for public cloud environments. The purpose of this is to puta limit on the number of resources that can be consumed if a specificservice gets into a situation that it attempts to consume unacceptableamounts of resource.

Referring to FIGS. 28 and 29, data node accommodation may be by regions,available zones, resources available on premises, and the like. Forinstance, there may be different regions, where each region may sharecertain capabilities, assets, identities, and the like; have datacenters assigned to them; have customer premises support assigned tothem; have a cloud node assigned to them; and the like. For instance, asshown, there may be a region A and a region B, where they may be able toshare certain resources. Region A and region B may also have their owndedicated data centers, such as data center A1, A2, and A3 for region A,and data center B1 and B2 for region B. These data centers may act asstand-alone data centers, or may be networked together, such as to sharedata, share configuration information, provide extended resources for adata center that needs to scale up due to activity. Customer premisesdata nodes and cloud data nodes may also be assigned to one region orthe other, such as based on the geographic location. This regional datastructure may provide regional flexibility as user needs drive scalingof the resources assigned to each user's solution.

Referring to FIG. 30, analytics may be a core service of a customizablesecure exchange facility, such as intelligently handling paradata(referred to in the figure as ‘exhaust’) that is siphoned off from useractivity and stored. An orchestration paradata service may, for example,capture de-identified data without needing to see the data itself.Paradata may be used for analytics and report processing of many kindsExamples of what paradata may be used for include elastic or dynamicscaling of services, compliance reporting, progress reporting, businessapplication reporting, customer usage reporting, billing reporting,customer specific reporting, transaction specific reporting, and thelike. Paradata pulls messages off the queue and stores the data in sucha way that accessing that data for reporting does not affect the basicperformance of the system. Stored data may be directly stored in theassociated data node, and stored in the orchestration layer asobfuscated data (e.g., with GUID—globally unique identifier). Forinstance, a user may have complete access to a data product stored inthe data node, but a secure server administrator associated with theorchestration layer may not be able to see the data in the data node,and only have access to obfuscated data through the orchestration layer.Paradata messaging may be organized, such as with a header (a basicversion and timestamp information), context (capturing the context ofthe message, e.g. which application, user, operation were involved),metadata (e.g., application specific data and system defined data),paradata (detailed status and debugging information, where the originalmessage is also included so any data can be retrieved at a later pointin time even if it wasn't originally defined as interesting), and thelike.

In embodiments, volume limitations may be improved through the use ofthe customizable secure exchange facility. For example, a traditionalplatform may have fixed volume limitations, such as an organizationlimit of 7500 users per monitored domain; a user limit of 5000 users perexchange and 2500 users per group; an exchange limit of 10,000 folders,20,000 documents, 200 top-level folders, 1000 documents per folder, 2500groups; a document limitation of 2 GB file size, 2000 files perdownload, 500 MB max download; and the like. However, with thescalability of the customizable secure exchange facility, volumelimitations may be virtually eliminated, where the enabling technologiesmay provide for a reporting infrastructure, asynchronous/non-blockingcalls, domain-level visibility processing, isolated optimized securitymodel, separating complex models from large domains, elastic services,horizontal scaling, distributed data, defined application patterns, andthe like.

In embodiments, the customizable secure exchange facility may providefor an increase in the development rate at which a user deploys a secureexchange environment, where different levels of integration may providedifferent levels of developmental velocity, such as from a more basicservices level, to a business process applications level with basicbuilding blocks, to business process applications and partners levelwith full components, to business process applications and partnercommunities including an applications building toolkit softwaredevelopment kit, and the like. These systems may scale up from forinstance, a standardized and automated environment creation environment,to a fully automated application development environment, to anindependent and isolated services environment, to an automated API andcomponent level testing environment, to full business applications, andthe like. The customizable secure exchange facility may enable users tohave greater control and customization potential for building uniquecollaborative sharing environments that are scalable such that volumelimitations are virtually eliminated.

Analytics and reporting may be provided through a group of services thatoperate both in, or with respect to, the orchestration and data nodeportions of the system. Those services that are referred to as paradatacapture all activity that occurs with respect to data. The analyticsservice is where data, metadata and paradata are organized in usefulways such that they can be used for solving various problems that rangefrom real time health and monitoring of the services, special purposereporting needs, to ad-hoc customer reporting, and the like. Analyticsand reporting may include compliance reporting, billing reports,customer usage reporting, and the like. In addition to reports formarket-to-cash applications, additional capabilities to support businesssystems may be provided, such as for throttling, provisioning, turningcapabilities on/off based on usage and adoption, and the like.Throttling is the ability to restrict access to system resources basedon limits defined in a business system is required. For example,resources that may be restricted (and the reasons for thoserestrictions) include disk space, processing (e.g. number of API callsper unit of time), features (e.g., the ability to turn features on/offbased on license agreements), applications (e.g., the ability toprovide/deny access to applications based on license agreements), systemaccess (e.g., the ability to provide/deny access to the system based onpayment or lack thereof), and the like. The business systems may need tohave the ability to query for how much of a given resource is beingutilized against specific contracts so that they can perform processingand notifications, such as when a client is approaching a specificpercentage of their allotted resource, when a client has used up theirallocation of an allotted resource, when a client has exceeded theirallocation for an allotted resource by a specific percentage in caseswhere exceeding allocation is allowed, and the like. Business systemsmay need to have the ability to shut off access to specific resources.Shutting off access may be temporary or permanent depending on thesituation. Some examples for when access needs to be shut off are when aclient does not pay their bill, when a trial period expires, and thelike.

A provisioning facility may be provided for provisioning of users andsystem containers (e.g. tenants, exchanges, workspaces, etc.) as needed,such as to get users up and running in various modes, including trialaccounts, ‘freemium’ accounts, paid accounts, and the like. The abilityto provision partners may also be provided, such as for different typesof partners that will need to be provisioned. Examples of the differentpartner types include partners who build and sell apps on top of ourplatform, partners who build and sell services used by our platform andapplications, partners (e.g., clients) who integrate our platform andapplications to their systems, developer (e.g., potential partners) whowant to experiment with the system's APIs, and the like. The ability forpartners to be administrators of their customers without systemadministrators may be needed, such as to provision accounts, provisionresources, monitor and throttle accounts and resources, administervarious aspects of their customer accounts, and the like.

In embodiments, other components and composites may be provided as partof the architecture, such as a business language services, lifecycleservices, tasking, collection/folder component, data policy composite,menu and commands, forms, tables, portal, tree, indented table,application builder toolkit, and the like. The platform may provide abusiness language that application teams, professional services,partners and customers can use to write applications. This language willenable the articulation of the business data model for an application aswell as a way to traverse that data model efficiently. Any object in thesystem may have a lifecycle associated with it, where the lifecycle is aseries of states through which the object traverses. Any portion of thebusiness data model that is hierarchical in nature can be thought of asa task structure. The business objects of that model are the tasksstarting at the top with the main ‘process’ task and working all the waydown through the structure to the deliverable (leaf) task nodes. Acollection (or folder) is a basic construct used for grouping otherdeliverables. Permissions may be based on the parents' permissions andmay be overridden at any point in the folder hierarchy or at individualdeliverables. How the system saves and allows data to be accessed may bepolicy driven, where there may be a need to be able to define basic datapolicy with respect to how long the data is to be retained on line or in‘cold storage’. Menu and commands may be the primary mechanism by whichusers interact with the user interface. They may be rendered as links,buttons, popup menus, and the like as needed. The primary presentationmay be the responsibility of the application creating the userinterface. The menu/command component may enable pre-check filtering,check and post action triggers for events, application, custom logic forprofessional services, custom logic for customers and partners, and thelike. A form component may present the user with a basic list ofname-value pairs of metadata. A table component may present the userwith a list of business objects and for each business object a series offields of data about those objects or objects they are related to. Theportal component is a composite screen that presents multiple widgets,such as a form, table, chart, graph, tree, lifecycle browser, menu andcommands, and the like. A tree component may provide a hierarchical viewand navigation of a structure. An indented table component may be acombination of the tree and table components. The application buildermay consist of a builder for prototyping and making quick modificationsto existing applications and a scripting language (e.g., XML) forbuilding full applications in such a way that they can be controlledusing source control management tools.

Referring to FIGS. 31A-31C, an embodiment of the data managementfacility is depicted, which provides orchestration services to thesystem with respect to content stored in data storage nodes. One skilledin the art will recognize that FIGS. 31A-31C represent one possibleimplementation of the data management facility and is not meant to belimiting in any way. These figures depict an implementation of the datamanagement facility this is configured as a virtual private cloud (VPC),where an on-demand configurable pool of shared computing resources isallocated within a public cloud environment, such as provided by Amazon,and isolated from other VPC users. Thus, use of a VPC enables the datamanagement facility to operate as a ‘virtually private’ cloud, secureand isolated from the public cloud. The VPC may be provided throughallocation of private and public IP subnets and virtual communicationsystems, such as with a virtual private network (VPN) that extends aprivate network across a public network (e.g., the Internet). The VPNmay be created by establishing virtual point-to-point connectionsthrough the use of dedicated connections, virtual tunneling protocols,traffic encryptions, and the like, enabling the security and managementresources of the customizable secure exchange system to extend out intothe public network as if it were directly connected to a privatenetwork, including authentication and encryption services, and withremote access to its VPC cloud-computing resources.

Referring specifically to the data management facility embodimentdepicted in FIGS. 31A-C, a client may access the VPC implementation ofthe data management facility, as well to a data storage node, through adata center and VPN connection to a virtual private gateway, whichconnects to allocated computing resources within the VPC (e.g. differentcomputing resource allocation zones), such as through an elastic loadbalancer (ELB) to distribute the incoming load across several instancesof service, such as for paradata and service manager. The system thenconnects to various highly available (HA) proxy private subnets, tocorrectly route request to the correct service. In embodiments, thevarious computing resource allocation zones may be interconnectedthrough ELB location and Paradata and ELB service managerscloud-computing resources within the VPC may be provided through aplurality of public and private subnets, such as for location services,paradata services, service management, threat management, and the like.In embodiments, public subnets may provide connectivity through anInternet gateway to commercial computing resources, such as, in alimited example, to Amazon™ cloud-computing resources (e.g., relationaldatabase service (RDS), simple storage service (S3), simple queueservice (SQS), elastic map reduce (EMR), simple workflow service (SWF),simple notification service (SNS), and the like), which may provide abroad set of scalable compute, storage, database, analytics,application, and deployment services. Although Amazon™ cloud-computingresources has been used here as a representative example of commercialcloud-computing resources, one skilled in the art will recognize thatsimilar cloud-computing resources are available from other commercialproviders, and is but one example embodiment of cloud-computingresources that may be employed by organizations implementing systemswithin the cloud-computing environment.

Referring to FIGS. 32A-C, embodiments of the data storage node may besimilarly implemented in a cloud-computing environment. Referringspecifically to the data storage node embodiment depicted in FIG. 32A-C,where in this instance it is implemented as an extension of theembodiment of the data management facility depicted in FIGS. 31A-C, aclient may access the data storage node through the data center, such asvia a virtual private customer gateway, virtual private network, networkinterfaces, and the like. This data storage node embodiment may employ aplurality of private subnets, such as for asset services, searchservices, transformation services, paradata management, servicemanagement, key management, and the like. In addition, data storagefacilities are provided. The cloud-computing embodiment depicted inFIGS. 32A-C is one embodiment of how the data storage node may beimplemented. In embodiments, a data storage node may be implemented in acloud-computing environment, behind an enterprise firewall as part ofthe enterprise computing resources, in a hybrid configuration betweenenterprise computing resources and cloud-computing resources, and thelike.

FIGS. 33A-D represent a non-limiting representative rack implementationfor a data storage node.

Federated Access Across Heterogeneous Content Repositories

Sharing data, whether as a part of a work or personal activity, has manyoptions in today's diverse, Internet and cloud environment. Some datasharing and storage processes and facilities are highly secure, such asfor an employee at work sharing and storing a document within anenterprise facility while operating a computer that resides on thenetwork and behind the enterprise's firewall. Some processes arerelatively less secure, such as an individual sharing a personaldocument from home to a public storage site. Further, there are manyprocesses that lie between these two extremes that may leave a documentin an uncertain security state. For instance, an employee may be workingfrom home and save a document to an enterprise storage facility. Or anemployee, operating from within an enterprise firewall, may wish toshare an enterprise-controlled document to a third party, where thethird party does not have a secure storage facility, or utilizesunsecure commercial cloud-storage facilities. In addition, documents maybe shared with the individual from outside the firewall, such that thedocument enters in an unknown security state, where the individual isalso put in a position of not knowing how to store that documentsecurely, send edits of that document back to the sender, and the like.This diversity of available content repositories makes it difficult todetermine the extent to which a document sharing-storage process issecure, or meets the requirements for security desired from anenterprise. This uncertainty makes it difficult to securely share andstore documents with others outside of an enterprise firewall.

In embodiments, a secure federated access facility may be provided foruniting heterogeneous content repositories (e.g., secure, public,private, commercial, inside a firewall, outside a firewall, etc.) undera single user interface, such as where file management is agnostic tothe location of content within the repositories. For instance, a user,operating through the user interface provided by the secure accessfacility, may view (e.g., seeing files and content items), access (e.g.,open, read), edit, save, share, and otherwise act on items stored inthese disparate content repositories as if they are part of, orextensions to, the user's network or file system. Thus, the user is ableto take actions on content items without having to think about thenature or location of the storage, or the type of security associatedwith the different repositories.

In embodiments, security is provided in the distinct repositories in amanner that complies with consistent policies and requirements, such asenterprise policies, no matter where content items are stored within theumbrella of repositories associated with the secure, federated accessfacility.

Referring to FIG. 38, in embodiments the federated access facility 3802may interface with, or within, an enterprise to provide federated accessservices amongst diverse data storage facilities, such as the enterprisedata storage 3830, a data storage 3812 for a second enterprise 3810(e.g., such as a partner of the enterprise, a vendor of the enterprise),a third-party secure data storage 3816, a third-party limited securitydata storage 3818, and the like. The federated access facility may alsointerface with data storage associated with computing devices 3828,3804B, 3806B that are internal to the enterprise and/or computingdevices 3804A, 3806A, 3808 that are external to the enterprise and/orsecond enterprise 3810.

The secure federated access facility 3802 may provide a unifiedarchitecture for federated access. The facility may be a web-enabled,multi-layered management-access environment that unites theheterogeneous content repositories, including uniting them withenterprise data storage (e.g., including on premises 3832 andcloud-based enterprise data storage 3820).

In embodiments, exchange features may be provided for securecollaboration across multiple business entities involving the documentsmanaged in the federated repositories. There may be, for instance, anorchestration layer, as described in this disclosure, for management ofthe system, where the orchestration layer is managed by a host thatmanages the underlying federated system, such as including trackinglocations of content items in heterogeneous repositories, managingsecure (e.g., key-based) access to content items (e.g., based onpolicies), logging metadata regarding to actions taken with respect toitems in repositories, and the like. In embodiments, the orchestrationlayer may access such data as metadata and file location data, but itmay be unable to provide access to the actual underlying content that isstored and managed by users in the various data storage facilities. Forexample, content itself may be encrypted with a different set of keys(e.g., customer-managed or managed by the vendor of a commercial storagesolution) than metadata and other items related to locating and trackingaccess to such content itself.

In embodiments, in association with the orchestration layer, a datalayer may provide for storing and management of data by a user, wherethe data node may provide a secure content storage facility managed bythe enterprise. The data layer may comprise data node(s), such asincluding a cloud-based data node 3820 outside the enterprise firewall,an appliance-based data node within the enterprise firewall 3824, an endpoint data node on a user device (e.g., mobile device or personalcomputer), and the like. In embodiments, content nodes include or arepart of data access engines that index and provide access to and controlmanagement and indexing of content. The data access engines may beassociated with an enterprise firewall, such as in a configuration whereas data is brought inside a firewall, such as an enterprise firewall3824, where the access engine takes control of management of the data.An access engine may, for example, take data from a connector, broker,service, or the like and encrypt the data as it is brought through anenterprise firewall. The access engine may tag data, add metadata, andotherwise provide security for such data, including managing accesspermission to access the data outside the firewall in the variousrepositories.

Sharing between members of the federated access facility may be frominside the federated sharing facility, where the federated accessfacility appears to be a single content system, with folders, datastreams, and communication streams for different users/groups. Thefederated access facility may provide translation facilities transparentto the user for translations of content extracted from, moved betweenand loaded to different repository formats (e.g., for repositories thatemploy different file types and different IRM protection schemes).Sharing a content item, such as a document, may then be handled as if itis merely a file management action, enabling the user to move documentsaround within the federated access facility as if the heterogeneousrepositories were one contiguous file management system, such as formoving files; duplicating, copying, pasting files; allocating a file toa data-stream; attaching a file to a communication-stream, and the like.In one embodiment, storing a file in an access repository mayautomatically implement security for the file, such as using encryptionor requiring access credentials, accounting for the log-on and storageenvironment of the storage environment. For example, dropping a fileinto a commercial cloud storage environment might automatically triggerencryption of the file, such that the file can be accessed only from thefederated access facility by an authorized party (including a thirdparty participant in an exchange, for example).

The functionality of the federated access facility may include a widerange of capabilities described throughout this disclosure, including,but not limited to, document-level IRM access control of shareddocuments, remote wipe control of shared documents, viewing and editingof non-native application documents, remote viewing of spreadsheetcontent, document use tracking for compliance and visibility,cross-platform synchronization, virtual window screen capture,host-client layered security environment, cloud-enabled virtual softwareapplications, application virtualization to client devices, end-pointsharing security, off-line file access, secure viewing of a document,location-based file access, and the like.

The secure federated access facility may provide federated contentaccess and management functionality across the various repositories,such as collaborative document actions, searching, auditing, accesspolicy implementation, security, e-discovery, and the like.Collaborative document actions may include sharing and un-sharing with anon-member of the facility, such as where inbound documents may betranslated and incorporated into the system. Outbound documents maycontain encapsulated metadata including document history, configurationinformation, and the like, such as to be re-incorporated when thedocument is shared again as an inbound document, across differentbusiness entities, and the like. Sharing activity history may be shared,post-sharing activity history may be shared, sharing may be providedwith intent functionality, there may be the capability to un-share(e.g., a remote device wipe), provide end-point sharing control, and thelike.

The secure federated access facility may provide federated viewingfunctionality, such as with the ability to securely view a documentstored on a diverse collection of repository types and from differentcomputing devices, including as stored on a secure repository 3816, on alimited security repository 3818, from a secure mobile device (e.g., anenterprise configured mobile computing device 3804A, 3804B), from anunsecure mobile device 3806A (e.g., personal device, a device connectedthrough an unsecure network), when a user is viewing off-line, when auser is viewing through a spreadsheet viewer, and the like. Viewpermissions may be shared and un-shared, provided through a secureviewing facility, viewed through a DRM sharing facility (e.g., withoutplugins), and the like.

Sharing may comprise permissioning, such as for access control (e.g.,read, write, copy, print), user credential permissioning, location-basedcredential permissioning (e.g., file location, file/repositorylocation), time-based credential permissioning, and the like. Auditingfunctionality may enable tracking what content was viewed (e.g.,including sub-parts of files), by whom, when, for what duration, and thelike. Auditing may comprise auditing metadata, such as without access todata (e.g., by an orchestration layer). Access restrictions may beprovided to improve security, such as with geo-location based accessrestrictions, network type access restrictions, personnel classificationaccess restrictions, and the like (e.g., implemented through IRMcontrols).

The secure federated access facility may provide policies for access tofederated repositories, such as for specifying who is allowed to storeor view documents on different types of repositories. For instance, aChief Information Officer (CIO) of an enterprise may want marketingpersonnel to have access to files stored in a commercial repository, butnot be able to share or store enterprise content in the commercialrepository. In another instance, engineering personnel may be able tostore content in a commercial repository, but the content may be IRMprotected. Policy may also specify how personal files are handled withinthe secure federated access facility. For instance, the system may allowemployees to access their personal files from the workplace, but informthem that their actions are auditable and that they may not put companyinformation at risk. In another instance, employees may be able to sharedocuments with outside parties that use commercial repositories, butthese actions may be auditable and include protection of files that areshared from the company to the partner.

Various types of content repositories may be accommodated within theconstruct of the secure federated access facility, including enterprisestorage inside and outside the firewall of the enterprise. Enterprisestorage outside the enterprise firewall may include company contentstored on a third-party secure facility 3816, a third-party unsecurefacility 3818, an employee personal device (e.g., device 3806B insideenterprise firewall 3824 and device 3806A outside the enterprisefirewall 3824 and outside firewall 3814), and the like. Content typesmay include enterprise finance database, financial data repository,human resources database, supply chain management database, analyticdatabases (e.g., for marketing), sales and inventory database, CRMdatabase, general enterprise databases, and the like.

Different repositories may have different formats and processesassociated with storage and access. The secure federated access facilitymay provide translation functionality for movement of content betweenrepositories, such as for moving content between different securerepositories, between an unsecure repository and a secure repository, asthe result of content inbound from outside user, outbound to outsideuser, and the like. Translation methodologies and topologies betweenheterogeneous repositories may be provided as direct connectors betweenrepositories (e.g., using various extraction, transformation, andloading (ETL) systems), using brokers/translators, using bridges orother intermediate connections and translation services (including inservice oriented architectures, such as using SOAP protocols or WSDL),as metadata-based connectors, using light data interchange formats(e.g., JSON) and the like.

Sharing content beyond the firewall may include both inbound andoutbound sharing. For instance, outbound sharing may be directly to asecond enterprise, such as to locations inside a second enterprisefirewall, to a second enterprise computing device outside eitherfirewall (e.g., in the field from one computing device to another acrossan unsecure network, to a portable data storage device), to athird-party secure facility, to a third-party unsecure facility, and thelike. Inbound sharing of content may be sharing directly from a secondenterprise 3810, such as from inside a second enterprise firewall 3814,from a second enterprise computing device 3808 outside second enterprisefirewall 3814 and/or outside enterprise firewall 3824 (e.g., in thefield from one computing device to another across an unsecure network),from a third-party secure facility, from a third-party unsecurefacility, and the like. Sharing content may be provided to/fromdifferent types of computer storage, including server-based (e.g.,inside the enterprise, cloud-based), desktop computer, laptop computer,tablet, smartphone, portable data storage device, storage disk, and thelike.

The secure federated access facility may provide a unified environmentwhere diverse content repositories, with varying levels of securityprotocols and process, may be accessible to a user without the userneeding to consider the security implications, formats, protocols, orprocesses of the different repositories. In addition, as differentcontent repositories typically have their own login, the securefederated access facility may provide a single-sign-on process for allsystems and repositories associated with the system. In this way, thesecure federated access facility may provide a single secure accessenvironment for all of the user's needs.

Additional Statements of Invention

The following clauses provide additional statements regarding theinventions disclosed herein.

Clause 1. A method for managing digital rights management (DRM)protected content sharing in a networked secure collaborative computerdata exchange environment, the method comprising: establishing, by asecure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; receiving computer data content and at least oneindicator of access rights for the computer data content from a firstuser of the plurality of users associated with a first organizationalentity of the plurality of other organizational entities, wherein thefirst user permits sharing access to the computer data content by atleast a second user of the plurality of users associated with a secondorganizational entity based on the indicated access rights, wherein thesecond organizational entity is one of the plurality of otherorganizational entities and is different than the first organizationalentity; transforming the computer data content into DRM-protectedcomputer data content through communications with a DRM engine, whereinthe DRM engine is selected based on a content type of the computer datacontent, and wherein the DRM engine is provided by an entity other thanthe intermediate organizational entity and other than any of theplurality of other organizational entities that access content sharedthrough the secure exchange facility; and granting, by the secureexchange facility, shared access to the DRM protected computer datacontent to at least the second user.

Clause 2. A method of clause 1, further comprising translating theaccess rights into a form that can be parsed by the DRM engine,forwarding, to the DRM engine, the translated access rights, andproviding, by the DRM engine, the translated access rights to at leastthe second user to enable the shared access to the DRM protectedcomputer data content.

Clause 3. The method of clause 1, wherein the access rights are manageddynamically by the intermediate organizational entity.

Clause 4. The method of clause 1, further comprising causing thecomputer data content to be registered with the DRM engine.

Clause 5. The method of clause 1, wherein the computer data content is asecure encrypted computer data content.

Clause 6. The method of clause 5, wherein at least one of the pluralityof other organizational entities manages its own encryption keys for usein encrypting computer data content.

Clause 7. The method of clause 6, wherein a hardware security module(HSM) is utilized in data encryption management, wherein the controllingsoftware deployed on the HSM is independently written and certified toensure that the intermediate organizational entity does not have accessto keys controlled by the at least one of the other organizationalentities.

Clause 8. The method of clause 6, wherein computer data content isencrypted with a data key, and the data key is encrypted with both acustomer key and a system master key to create double-encrypted computerdata content.

Clause 9. The method of clause 8, wherein double-encryption of computerdata content is applied at a plurality of levels of content management.

Clause 10. The method of clause 9, wherein a level of content managementcomprises at least one of at a company level, a department level, awork-stream level, and a computer data content level.

Clause 11. The method of clause 1, further comprising: receiving fromthe first user an indicator of revision to access rights that revokessharing access to the computer data content to at least the second user;wherein the computer data content and revised access rights for thecomputer data content are transformed into a revised DRM protectedcomputer data content through communications with the DRM engine; andrevoking, by the secure exchange facility, sharing access to thecomputer data content to at least the second user.

Clause 12. The method of clause 11, further comprising enablingadditional sharing of the computer data content within the plurality ofusers, wherein the revoking of sharing access to the computer datacontent revokes access to all instances of the shared computer datacontent and all copies of the computer data content made by theplurality of users.

Clause 13. The method of clause 11, wherein the computer data content isat least one of a word processor document, a spreadsheet document, and apresentation document.

Clause 14. The method of clause 11, wherein the second user is connectedto a public network that is outside of a firewall of the organizationalentity that manages the first user or the second user.

Clause 15. The method of clause 11, wherein the second user accesses thecomputer data content through a personal computing device that is notowned by the organizational entity that manages the second user.

Clause 16. The method of clause 1, wherein the secure exchange facilityfurther comprises a data management facility and plurality of datastorage nodes, wherein the data management facility is managed by theintermediate organizational entity and is adapted to providepermissioned control to the plurality of other organizational entitiesfor use of at least one of the plurality of data storage nodes, whereineach of the other organizational entities is granted permissionedcontrol of at least one of the plurality of data storage nodes by theintermediate organizational entity for storing data comprised of thecontent and metadata, wherein the data management facility managessecure data exchange of the content through the data storage nodes, andwherein the data management facility has access to the metadata of thestored data for managing sharing of the content via the data storagenodes, but the data management facility does not have access to thecontent.

Clause 17. The method of clause 16, wherein the data management facilityis distributed into a plurality of data management sites to enablemanagement of the plurality of data storage nodes.

Clause 18. The method of clause 16, wherein the plurality of datastorage nodes are located at network locations separate from the datamanagement facility and specified by the plurality of organizationalentities.

Clause 19. The method of clause 16, wherein the metadata providesinformation associated with the content to enable management of thecontent by the data management facility without the data managementfacility having access to the content.

Clause 20. The method of clause 19, wherein the information comprises atleast one of content creation information, content revision history,geographic location information, content viewing history, enterpriseidentification information, and digital rights management information.

Clause 21. The method of clause 16, wherein the plurality of datamanagement sites are distributed geographically and the plurality ofdata storage nodes are managed in a manner specific to their geographiclocation.

Clause 22. The method of clause 16, wherein the secure exchange facilityprovides content services to the plurality of data storage nodes thatoperate on and store the content, store metadata, provide at least oneof data transformation and filtering to the content, provide analyticsrelated to the content, and provide searching tools for the searchingfor content.

Clause 23. The method of clause 22, wherein the at least one of datatransformation and filtering is at least one of container-specific,application-specific, and customer-specific.

Clause 24. The method of clause 22, wherein the at least one of datatransformation and filtering is at least one of a virus scan,publishing, search index, document encryption, bulk download, office topdf transform, DRM application, file chunking, office web applicationprocessing, unique file naming per folder, and business level fieldvalidation.

Clause 25. The method of clause 1, further comprising providing aplurality of content repositories for storing the computer data content.

Clause 26. The method of clause 25, wherein at least one of theplurality of content repositories is outside the management of theintermediate organizational entity, wherein collectively the pluralityof content repositories including the at least one of the plurality ofcontent repositories outside the management of the intermediateorganizational entity comprises a plurality of heterogeneous contentrepositories.

Clause 27. The method of clause 26, further comprising providing asecure federated access facility for uniting access to the plurality ofheterogeneous content repositories through a single user interface.

Clause 28. The method of clause 27, wherein the federated accessfacility appears to a user of the user interface to be a single computerdata content system.

Clause 29. The method of clause 27, wherein at least one of theplurality of heterogeneous content repositories is a data storagefacility outside a firewall of the intermediate organizational entityand outside any firewalls of the plurality of other organizationalentities.

Clause 30. The method of clause 29, wherein the at least one of theplurality of heterogeneous content repositories is a data storagefacility within a mobile computing device being operated by one of theplurality of users outside the firewall of the intermediateorganizational entity and outside any firewalls of the plurality ofother organizational entities.

Clause 31. The method of clause 29, wherein the at least one of theplurality of heterogeneous content repositories is a data storagefacility operated by a commercial cloud-based data storage entity.

Clause 32. The method of clause 27, wherein at least one of theplurality of heterogeneous content repositories is a data storagefacility outside the firewall of the intermediate organizational entityand the plurality of other organizational entities, and at least one ofthe plurality of heterogeneous content repositories is a data storagefacility that is inside the firewall of at least one of the plurality ofother organizational entities.

Clause 33. The method of clause 1, further comprising receiving secondcomputer data content from the first user, and providing a digitalrights authentication service that permits the second user to access thecomputer data content and the second computer data content uponreception of a single digital rights management authentication, therebyenabling the second user to access both computer data content itemswithout providing authentication for more than one of the two computerdata content items.

Clause 34. The method of clause 1, further comprising providing a securemanaged key facility for managing encryption keys used to encrypt thecomputer data content, wherein the secure managed key facility generatesa content key for encrypting the computer data content along with acontent key reference, wherein the content key reference is stored alongwith the computer data content, and the content key reference istransferred along with the computer data content to the second user onceshared access is granted.

Clause 35. The method of clause 34, wherein the second user, uponreception of the computer data content, sends the content key referenceto the secure managed key facility, which then retrieves the content keyfrom storage for decryption of the computer data content.

Clause 36. The method of clause 35, wherein the secure managed keyfacility sends the content key to the second user for decryption of thecomputer data content.

Clause 37. The method of clause 1, wherein communications between thesecure exchange facility and the plurality of other organizationalentities is encrypted, and the encryption key is generated on a per userbasis.

Clause 38. The method of clause 1, further comprising providing adynamic entitlement management facility, wherein the dynamic entitlementmanagement facility enables a DRM-based entitlement permission to bedynamically changed based on a contextual indication.

Clause 39. The method of clause 38, wherein the entitlement permissionis at least one of access permission, synchronization permission, andsharing permission.

Clause 40. The method of clause 38, wherein the contextual indicationincludes at least one of a geographic location, a location context, anetwork condition, and an indicator of collaboration connectivity inassociation with the second user.

Clause 41. The method of clause 1, further comprising an action checkingfacility, wherein the action checking facility manages actions withrespect to an application capability resident on the computer device ofat least one of the first user and the second user.

Clause 42. The method of clause 41, wherein the action is the first usersharing the computer data content with the second user.

Clause 43. The method of clause 41, wherein the action is the seconduser requesting access to the computer data content.

Clause 44. The method of clause 41, wherein the action checking facilitymanages actions based on at least one of licensing conditions, thenature of the applications that are installed on the computing device,and the permissions for the user.

Clause 45. The method of clause 1, further comprising providing a securemobile device facility to manage a trusted environment policy for aplurality of mobile devices used by the plurality of users, wherein theplurality of mobile devices are able to securely inter-communicate witheach other within a trusted environment.

Clause 46. The method of clause 45, wherein each of the plurality ofmobile devices is verified as a trusted device before being included asa mobile device within the trusted environment.

Clause 47. The method of clause 45, wherein the trusted environment isconstrained by at least one of a physical location, a networkconnection, and a near-field proximity among the plurality of mobiledevices.

Clause 48. The method of clause 1, further comprising providing acollaborative customer relationship management (CRM) facility, whereinthe collaborative CRM facility is used in conjunction with a multi-partycollaboration in order to track contacts and communications of theplurality of users.

Clause 49. The method of clause 1, further comprising providing awork-stream synchronization facility, wherein the work-streamsynchronization facility provides the ability for a secure collaborationcontainer of a user to be synchronized onto a desktop work-streamchannel of the user.

Clause 50. The method of clause 49, wherein the secure collaborationcontainer is stored in a computing cloud.

Clause 51. The method of clause 50, wherein work-stream synchronizationenables management of conflicts.

Clause 52. The method of clause 1, further comprising providing acontextual sharing facility, wherein the contextual sharing facilitymanages the sharing of the computer data content based on the contextualenvironment of at least one of the first user and the second user.

Clause 53. The method of clause 52, wherein the contextual environmentis at least one of the computing device that a user is utilizing in thesharing of the computer data content, location of the computing device,a current activity state of a user, network conditions, proximity toother users, time of day, and a restrictive list.

Clause 54. The method of clause 1, wherein sharing of the computer datacontent by the first user is restricted based on at least one of the IPaddress and the domain name associated with the computing device of thefirst user.

Clause 55. The method of clause 54, wherein the first organizationalentity of the first user provides a list of acceptable IP addresses forspecified network domains that the secure exchange facility may use toestablish an access restriction rule.

Clause 56. The method of clause 1, further comprising applicationprogramming interface (API) functionality between the secure exchangefacility and the plurality of other organizational entities.

Clause 57. The method of clause 56, wherein the functionality for aplurality of different APIs is provided in an API wrapper, that allows adeveloper to specify interactions with a plurality of APIs through asingle function.

Clause 58. The method of clause 1, wherein the computer data content isencrypted when transferred from a computer of the first user to thesecure exchange facility, transferred within the secure exchangefacility, stored within the secure exchange facility, and transferredfrom the secure exchange facility to a computer of the second user.

Clause 59. The method of clause 58, wherein the computer data content isdouble-key encrypted with a first key encryption and a second keyencryption while stored within the secure exchange facility, wherein thefirst key encryption is provided by the secure exchange facility and thesecond key encryption is provided by the first organizational entity ofthe first user.

Clause 60. The method of clause 59, wherein the computer data content isdata rights management (DRM) encrypted before the computer data contentis transferred from the secure exchange facility to the computer of thesecond user.

Clause 61. The method of clause 60, wherein the DRM encryption isprovided through a third-party organizational entity that is notcontrolled by the intermediate organizational entity or one of theplurality of other organizational entities.

Clause 62. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, wherein a first user of theplurality of users is associated with a first organizational entity ofthe plurality of other organizational entities, and whereincommunication between the secure exchange facility and the plurality ofusers is through a communications network; receiving computer datacontent from the first user, wherein the first user permits sharingaccess to the computer data content by at least a second user of theplurality of users associated with a second organizational entitydifferent than the first organizational entity; encrypting the computerdata content, wherein the first organizational entity manages its ownencryption keys for use in encrypting computer data content; andgranting, by the secure exchange facility, shared access to the computerdata content to the second user.

Clause 63. The method of clause 62, wherein the computer data content isencrypted with a data key by the secure exchange facility, the data keyis then encrypted with a customer key managed by the firstorganizational entity, the customer key encrypted data key is thenencrypted with a system master key managed by the secure exchangefacility to create a double-encrypted data key to protect the computerdata content, wherein the unencrypted data key is then made inaccessiblein order to enable access to the computer data content only through boththe customer key and the system master key.

Clause 64. The method of clause 63, wherein a hardware security module(HSM) with controlling software is utilized in the management of thecustomer key, wherein the controlling software is deployed on the HSMand is independently written and certified to ensure that theintermediate organizational entity does not have access to the customerkey controlled by first organizational entity.

Clause 65. The method of clause 62, wherein the computer data content isencrypted with both a customer key and a system master key to create adouble-encrypted computer data content.

Clause 66. The method of clause 65, wherein the customer key is managedby the first organizational entity and the system master key is managedby the intermediate organizational entity such that the intermediateentity is unable to decrypt the encrypted computer data content withonly the system master key.

Clause 67. The method of clause 62, wherein the customer managed keysare protected through digital rights management (DRM) technologiesmanaged by the first organizational entity.

Clause 68. The method of clause 62, wherein the first organizationalentity has a plurality of customer encryption keys comprising at least afirst customer encryption key identified with a first key identifier anda second customer encryption key identified with a second keyidentifier, and rotating the use of the first customer encryption keyfor the second customer encryption key with reference to the first andsecond key identifiers without the need for the intermediateorganizational entity to have access to either the first or secondcustomer encryption keys.

Clause 69. The method of clause 62, wherein the management of encryptionkeys by the first organizational entity is applied at a plurality oflevels of content management.

Clause 70. The method of clause 69, wherein a level of contentmanagement comprises at least one of at a company level, a departmentlevel, a work-stream level, and a computer data content level.

Clause 71. The method of clause 69, wherein a level of contentmanagement comprises a company level and a computer data content levelsuch that the first organizational entity can manage access to at leasteither all computer data content shared by the first organizationalentity in the secure exchange facility or at the computer data contentlevel for control over access to individual computer data content sharedby the first organizational entity in the secure exchange facility.

Clause 72. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: providing asecure exchange facility comprising a data management facility andplurality of data storage nodes, wherein the data management facility ismanaged by the intermediate organizational entity and adapted to providepermissioned control to the plurality of other organizational entitiesfor use of at least one of the plurality of data storage nodes, whereineach of the other organizational entities is granted permissionedcontrol of at least one of the plurality of data storage nodes by theintermediate organizational entity for storing data comprised of thecontent and metadata, wherein the data management facility managessecure data exchange of the content through the data storage nodes, andwherein the data management facility has access to the metadata of thestored data for managing sharing of the content via the data storagenodes, but the data management facility does not have access to thecontent, wherein the secure exchange facility provides content servicesto the plurality of data storage nodes that operate on and store thecontent, store metadata, and provide at least one of data transformationand filtering to the content; establishing, by the secure exchangefacility managed by an intermediate organizational entity, a user logindata authentication procedure that allows a user through at least oneclient computing device to access the secure exchange facility, whereinthe user is one of a plurality of users of a plurality of otherorganizational entities that access content shared through the secureexchange facility, where communication between the secure exchangefacility and the plurality of users is through a communications network;receiving computer data content from a first user of the plurality ofusers associated with a first organizational entity, wherein the firstuser permits sharing access to the computer data content by at least asecond user of the plurality of users associated with a secondorganizational entity different than the first organizational entity;and granting, by the secure exchange facility, shared access to thecomputer data content to at least the second user.

Clause 73. The method of clause 72, wherein the at least one of datatransformation and filtering is at least one of container-specific,application-specific, and customer-specific.

Clause 74. The method of clause 72, wherein the at least one of datatransformation and filtering is at least one of a virus scan,publishing, search index, document encryption, bulk download, office topdf transform, DRM application, file chunking, office web applicationprocessing, unique file naming per folder, and business level fieldvalidation.

Clause 75. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network, wherein the secure exchange facility is adaptedto access a plurality of content repositories for storing the computerdata content, wherein at least one of the plurality of contentrepositories is outside the management of the intermediateorganizational entity, wherein collectively the plurality of contentrepositories including the at least one of the plurality of contentrepositories outside the management of the intermediate organizationalentity comprises a plurality of heterogeneous content repositories;receiving computer data content from a first user of the plurality ofusers associated with a first organizational entity, wherein the firstuser permits sharing access to the computer data content by at least asecond user of the plurality of users associated with a secondorganizational entity different than the first organizational entity;and granting, by the secure exchange facility, shared access to thecomputer data content to at least the second user.

Clause 76. The method of clause 75, further comprising providing asecure federated access facility for uniting access to the plurality ofheterogeneous content repositories through a single user interface.

Clause 77. The method of clause 76, wherein the federated accessfacility appears to a user of the user interface to be a single computerdata content system.

Clause 78. The method of clause 76, wherein at least one of theplurality of heterogeneous content repositories is a data storagefacility outside a firewall of the intermediate organizational entityand outside any firewalls of the plurality of other organizationalentities.

Clause 79. The method of clause 78, wherein the at least one of theplurality of heterogeneous content repositories is a data storagefacility within a mobile computing device being operated by one of theplurality of users outside the firewall of the intermediateorganizational entity and outside any firewalls of the plurality ofother organizational entities.

Clause 80. The method of clause 78, wherein the at least one of theplurality of heterogeneous content repositories is a data storagefacility operated by a commercial cloud-based data storage entity.

Clause 81. The method of clause 76, wherein at least one of theplurality of heterogeneous content repositories is a data storagefacility outside a firewall of the intermediate organizational entityand any firewalls of the plurality of other organizational entities, andat least one of the plurality of heterogeneous content repositories is adata storage facility that is inside a firewall of at least one of theplurality of other organizational entities.

Clause 82. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; receiving first and second computer data contentfrom a first user of the plurality of users associated with a firstorganizational entity, wherein the first user permits sharing access tothe first and second computer data content by at least a second user ofthe plurality of users associated with a second organizational entitydifferent than the first organizational entity; and providing a digitalrights authentication service that permits the second user to access thefirst and second computer data content upon reception of a singledigital rights management authentication, thereby enabling the seconduser to access the first and second computer data content withoutproviding authentication for more than one of the first and secondcomputer data content.

Clause 83. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; receiving computer data content from a firstuser of the plurality of users associated with a first organizationalentity, wherein the first user permits sharing access to the computerdata content by at least a second user of the plurality of usersassociated with a second organizational entity different than the firstorganizational entity; providing a secure managed key facility formanaging encryption keys used to encrypt the computer data content,wherein the secure managed key facility generates a content key forencrypting the computer data content along with a content key reference,wherein the content key reference is stored along with the computer datacontent, and the content key reference is transferred along with thecomputer data content to at least the second user once shared access isgranted; and granting, by the secure exchange facility, shared access tothe computer data content to at least the second user.

Clause 84. The method of clause 83, wherein the second user, uponreception of the computer data content, sends the content key referenceto the secure managed key facility, which then retrieves the content keyfrom storage for decryption of the computer data content.

Clause 85. The method of clause 84, wherein the secure managed keyfacility sends the content key to the second user for decryption of thecomputer data content.

Clause 86. The method of clause 83, wherein communications between thesecure exchange facility and the plurality of other organizationalentities is encrypted, and the encryption key is generated on a per userbasis.

Clause 87. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; providing a dynamic entitlement managementfacility, wherein the dynamic entitlement management facility enables aDRM-based entitlement permission to be dynamically changed based on acontextual indication; receiving computer data content from a first userof the plurality of users associated with a first organizational entity,wherein the first user permits sharing access to the computer datacontent by at least a second user of the plurality of users associatedwith a second organizational entity different than the firstorganizational entity; and granting, by the secure exchange facility,shared access to the computer data content to at least the second user.

Clause 88. The method of clause 87, wherein the entitlement permissionis at least one of access permission, synchronization permission, andsharing permission.

Clause 89. The method of clause 87, wherein the contextual indicationincludes at least one of a geographic location, a location context, anetwork condition, and an indicator of collaboration connectivity inassociation with at least the second user.

Clause 90. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; providing an action checking facility, whereinthe action checking facility manages actions with respect to anapplication capability resident on the computer device of at least oneof a first user of a first organizational entity and a second user of asecond organizational entity different than the first organizationalentity, wherein each of the first user and the second user are one ofthe plurality of users; receiving computer data content from the firstuser, wherein the first user permits sharing access to the computer datacontent by at least the second user; and granting, by the secureexchange facility, shared access to the computer data content to atleast the second user.

Clause 91. The method of clause 90, wherein the action is the first usersharing the computer data content with the second user.

Clause 92. The method of clause 90, wherein the action is the seconduser requesting access to the computer data content.

Clause 93. The method of clause 90, wherein the action checking facilitymanages actions based on at least one of licensing conditions, thenature of the applications that are installed on the computing device,and the permissions for the user.

Clause 94. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one mobile computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; providing a secure mobile device facility tomanage a trusted environment policy for a plurality of mobile computingdevices used by the plurality of users, wherein the plurality of mobiledevices are able to securely inter-communicate with each other within atrusted environment; receiving computer data content from a first userof the plurality of users associated with a first organizational entity,wherein the first user permits sharing access to the computer datacontent by at least a second user of the plurality of users associatedwith a second organizational entity different than the firstorganizational entity; and granting, by the secure exchange facility,shared access to the computer data content to at least the second user.

Clause 95. The method of clause 94, wherein each of the plurality ofmobile devices is verified as a trusted device before being included asa mobile device within the trusted environment.

Clause 96. The method of clause 94, wherein the trusted environment isconstrained by at least one of a physical location, a networkconnection, and a near-field proximity among the plurality of mobiledevices.

Clause 97. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; providing a collaborative customer relationshipmanagement (CRM) facility, wherein the collaborative CRM facility isused in conjunction with a multi-party collaboration in order to trackcontacts and communications of the plurality of users; receivingcomputer data content from a first user of the plurality of usersassociated with a first organizational entity, wherein the first userpermits sharing access to the computer data content by at least a seconduser of the plurality of users associated with a second organizationalentity different than the first organizational entity; and granting, bythe secure exchange facility, shared access to the computer data contentto at least the second user.

Clause 98. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; providing a work-stream synchronizationfacility, wherein the work-stream synchronization facility provides theability for a secure collaboration container of a user to besynchronized onto a desktop work-stream channel of the user; receivingcomputer data content from a first user of the plurality of usersassociated with a first organizational entity, wherein the first userpermits sharing access to the computer data content by at least a seconduser of the plurality of users associated with a second organizationalentity different than the first organizational entity; and granting, bythe secure exchange facility, shared access to the computer data contentto at least the second user.

Clause 99. The method of clause 98, wherein the secure collaborationcontainer is stored in a computing cloud.

Clause 100. The method of clause 99, wherein work-stream synchronizationenables management of conflicts.

Clause 101. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; receiving computer data content from a firstuser of the plurality of users associated with a first organizationalentity, wherein the first user permits sharing access to the computerdata content by at least a second user of the plurality of usersassociated with a second organizational entity different than the firstorganizational entity; providing a contextual sharing facility, whereinthe contextual sharing facility manages the sharing of the computer datacontent based on the contextual environment of at least one of the firstand second users of the plurality of users; and granting, by the secureexchange facility, shared access to the computer data content to atleast the second user.

Clause 102. The method of clause 101, wherein the contextual environmentis at least one of the computing device that a user is utilizing in thesharing of the computer data content, location of the computing device,a current activity state of a user, network conditions, proximity toother users, time of day, and a restrictive list.

Clause 103. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; receiving computer data content from a firstuser of the plurality of users associated with a first organizationalentity, wherein the first user permits sharing access to the computerdata content by at least a second user of the plurality of usersassociated with a second organizational entity different than the firstorganizational entity, wherein sharing of the computer data content bythe first user is restricted based on at least one of the IP address andthe domain name associated with the computing device of the first user;and granting, by the secure exchange facility, shared access to thecomputer data content to at least the second user.

Clause 104. The method of clause 103, wherein the organizational entityof the first user provides a list of acceptable IP addresses forspecified network domains that the secure exchange facility may use toestablish an access restriction rule.

Clause 105. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network, wherein application programming interface (API)functionality is provided by the secure exchange facility forinterfacing with the plurality of other organizational entities;receiving computer data content from a first user of the plurality ofusers associated with a first organizational entity, wherein the firstuser permits sharing access to the computer data content by at least asecond user of the plurality of users associated with a secondorganizational entity different than the first organizational entity;and granting, by the secure exchange facility, shared access to thecomputer data content to at least the second user.

Clause 106. The method of clause 105, wherein the functionality for aplurality of different APIs is provided in an API wrapper that allows adeveloper to specify interactions with a plurality of APIs through asingle function.

Clause 107. A method for managing a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network, wherein the computer data content is encryptedwhen transferred from a computer of the first of the plurality of usersto the secure exchange facility, transferred within the secure exchangefacility, stored within the secure exchange facility, and transferredfrom the secure exchange facility to a computer of the second of theplurality of users; receiving computer data content from a first user ofthe plurality of users associated with a first organizational entity,wherein the first user permits sharing access to the computer datacontent by at least a second user of the plurality of users associatedwith a second organizational entity different than the firstorganizational entity; and granting, by the secure exchange facility,shared access to the computer data content to at least the second user.

Clause 108. The method of clause 107, wherein the computer data contentis double-key encrypted with a first key encryption and a second keyencryption while stored within the secure exchange facility, wherein thefirst key encryption is provided by the secure exchange facility and thesecond key encryption is provided by the first organizational entity ofthe first user and which is one of the plurality of other organizationalentities.

Clause 109. The method of clause 108, wherein the computer data contentis data rights management (DRM) encrypted before the computer datacontent is transferred from the secure exchange facility to the computerof the second user.

Clause 110. The method of clause 109, wherein the DRM encryption isprovided through a third-party organizational entity that is notassociated with the intermediate organizational entity or one of theplurality of other organizational entities.

While the invention has been described in connection with certainpreferred embodiments, other embodiments would be understood by one ofordinary skill in the art and are encompassed herein. The methods andsystems described herein may be deployed in part or in whole through amachine that executes computer software, program codes, and/orinstructions on a processor. The present invention may be implemented asa method on the machine, as a system or apparatus as part of or inrelation to the machine, or as a computer program product embodied in acomputer readable medium executing on one or more of the machines. Theprocessor may be part of a server, client, network infrastructure,mobile computing platform, stationary computing platform, or othercomputing platform. A processor may be any kind of computational orprocessing device capable of executing program instructions, codes,binary instructions and the like. The processor may be or include asignal processor, digital processor, embedded processor, microprocessoror any variant such as a co-processor (math co-processor, graphicco-processor, communication co-processor and the like) and the like thatmay directly or indirectly facilitate execution of program code orprogram instructions stored thereon. In addition, the processor mayenable execution of multiple programs, threads, and codes. The threadsmay be executed simultaneously to enhance the performance of theprocessor and to facilitate simultaneous operations of the application.By way of implementation, methods, program codes, program instructionsand the like described herein may be implemented in one or more thread.The thread may spawn other threads that may have assigned prioritiesassociated with them; the processor may execute these threads based onpriority or any other order based on instructions provided in theprogram code. The processor may include memory that stores methods,codes, instructions and programs as described herein and elsewhere. Theprocessor may access a storage medium through an interface that maystore methods, codes, and instructions as described herein andelsewhere. The storage medium associated with the processor for storingmethods, programs, codes, program instructions or other type ofinstructions capable of being executed by the computing or processingdevice may include but may not be limited to one or more of a CD-ROM,DVD, memory, hard disk, flash drive, RAM, ROM, cache and the like.

A processor may include one or more cores that may enhance speed andperformance of a multiprocessor. In embodiments, the process may be adual core processor, quad core processors, other chip-levelmultiprocessor and the like that combine two or more independent cores(called a die).

The methods and systems described herein may be deployed in part or inwhole through a machine that executes computer software on a server,client, firewall, gateway, hub, router, or other such computer and/ornetworking hardware. The software program may be associated with aserver that may include a file server, print server, domain server,internet server, intranet server and other variants such as secondaryserver, host server, distributed server and the like. The server mayinclude one or more of memories, processors, computer readable media,storage media, ports (physical and virtual), communication devices, andinterfaces capable of accessing other servers, clients, machines, anddevices through a wired or a wireless medium, and the like. The methods,programs or codes as described herein and elsewhere may be executed bythe server. In addition, other devices required for execution of methodsas described in this application may be considered as a part of theinfrastructure associated with the server.

The server may provide an interface to other devices including, withoutlimitation, clients, other servers, printers, database servers, printservers, file servers, communication servers, distributed servers andthe like. Additionally, this coupling and/or connection may facilitateremote execution of program across the network. The networking of someor all of these devices may facilitate parallel processing of a programor method at one or more location without deviating from the scope ofthe invention. In addition, any of the devices attached to the serverthrough an interface may include at least one storage medium capable ofstoring methods, programs, code and/or instructions. A centralrepository may provide program instructions to be executed on differentdevices. In this implementation, the remote repository may act as astorage medium for program code, instructions, and programs.

The software program may be associated with a client that may include afile client, print client, domain client, internet client, intranetclient and other variants such as secondary client, host client,distributed client and the like. The client may include one or more ofmemories, processors, computer readable media, storage media, ports(physical and virtual), communication devices, and interfaces capable ofaccessing other clients, servers, machines, and devices through a wiredor a wireless medium, and the like. The methods, programs or codes asdescribed herein and elsewhere may be executed by the client. Inaddition, other devices required for execution of methods as describedin this application may be considered as a part of the infrastructureassociated with the client.

The client may provide an interface to other devices including, withoutlimitation, servers, other clients, printers, database servers, printservers, file servers, communication servers, distributed servers andthe like. Additionally, this coupling and/or connection may facilitateremote execution of program across the network. The networking of someor all of these devices may facilitate parallel processing of a programor method at one or more location without deviating from the scope ofthe invention. In addition, any of the devices attached to the clientthrough an interface may include at least one storage medium capable ofstoring methods, programs, applications, code and/or instructions. Acentral repository may provide program instructions to be executed ondifferent devices. In this implementation, the remote repository may actas a storage medium for program code, instructions, and programs.

The methods and systems described herein may be deployed in part or inwhole through network infrastructures. The network infrastructure mayinclude elements such as computing devices, servers, routers, hubs,firewalls, clients, personal computers, communication devices, routingdevices and other active and passive devices, facilities and/orcomponents as known in the art. The computing and/or non-computingdevice(s) associated with the network infrastructure may include, apartfrom other components, a storage medium such as flash memory, buffer,stack, RAM, ROM and the like. The processes, methods, program codes,instructions described herein and elsewhere may be executed by one ormore of the network infrastructural elements.

The methods, program codes, and instructions described herein andelsewhere may be implemented on a cellular network having multiplecells. The cellular network may either be frequency division multipleaccess (FDMA) network or code division multiple access (CDMA) network.The cellular network may include mobile devices, cell sites, basestations, repeaters, antennas, towers, and the like. The cell networkmay be a GSM, GPRS, 3G, EVDO, mesh, or other networks types.

The methods, programs codes, and instructions described herein andelsewhere may be implemented on or through mobile devices. The mobiledevices may include navigation devices, cell phones, mobile phones,mobile personal digital assistants, laptops, palmtops, netbooks, pagers,electronic books readers, music players and the like. These devices mayinclude, apart from other components, a storage medium such as a flashmemory, buffer, RAM, ROM and one or more computing devices. Thecomputing devices associated with mobile devices may be enabled toexecute program codes, methods, and instructions stored thereon.Alternatively, the mobile devices may be configured to executeinstructions in collaboration with other devices. The mobile devices maycommunicate with base stations interfaced with servers and configured toexecute program codes. The mobile devices may communicate on a peer topeer network, mesh network, or other communications network. The programcode may be stored on the storage medium associated with the server andexecuted by a computing device embedded within the server. The basestation may include a computing device and a storage medium. The storagedevice may store program codes and instructions executed by thecomputing devices associated with the base station.

The computer software, program codes, and/or instructions may be storedand/or accessed on machine readable media that may include: computercomponents, devices, and recording media that retain digital data usedfor computing for some interval of time; semiconductor storage known asrandom access memory (RAM); mass storage typically for more permanentstorage, such as optical discs, forms of magnetic storage like harddisks, tapes, drums, cards and other types; processor registers, cachememory, volatile memory, non-volatile memory; optical storage such asCD, DVD; removable media such as flash memory (e.g. USB sticks or keys),floppy disks, magnetic tape, paper tape, punch cards, standalone RAMdisks, Zip drives, removable mass storage, off-line, and the like; othercomputer memory such as dynamic memory, static memory, read/writestorage, mutable storage, read only, random access, sequential access,location addressable, file addressable, content addressable, networkattached storage, storage area network, bar codes, magnetic ink, and thelike.

The methods and systems described herein may transform physical and/oror intangible items from one state to another. The methods and systemsdescribed herein may also transform data representing physical and/orintangible items from one state to another.

The elements described and depicted herein, including in flow charts andblock diagrams throughout the figures, imply logical boundaries betweenthe elements. However, according to software or hardware engineeringpractices, the depicted elements and the functions thereof may beimplemented on machines through computer executable media having aprocessor capable of executing program instructions stored thereon as amonolithic software structure, as standalone software facilities, or asfacilities that employ external routines, code, services, and so forth,or any combination of these, and all such implementations may be withinthe scope of the present disclosure. Examples of such machines mayinclude, but may not be limited to, personal digital assistants,laptops, personal computers, mobile phones, other handheld computingdevices, medical equipment, wired or wireless communication devices,transducers, chips, calculators, satellites, tablet PCs, electronicbooks, gadgets, electronic devices, devices having artificialintelligence, computing devices, networking equipment, servers, routersand the like. Furthermore, the elements depicted in the flow chart andblock diagrams or any other logical component may be implemented on amachine capable of executing program instructions. Thus, while theforegoing drawings and descriptions set forth functional aspects of thedisclosed systems, no particular arrangement of software forimplementing these functional aspects should be inferred from thesedescriptions unless explicitly stated or otherwise clear from thecontext. Similarly, it will be appreciated that the various stepsidentified and described above may be varied, and that the order ofsteps may be adapted to particular applications of the techniquesdisclosed herein. All such variations and modifications are intended tofall within the scope of this disclosure. As such, the depiction and/ordescription of an order for various steps should not be understood torequire a particular order of execution for those steps, unless requiredby a particular application, or explicitly stated or otherwise clearfrom the context.

The methods and/or processes described above, and steps thereof, may berealized in hardware, software or any combination of hardware andsoftware suitable for a particular application. The hardware may includea general purpose computer and/or dedicated computing device or specificcomputing device or particular aspect or component of a specificcomputing device. The processes may be realized in one or moremicroprocessors, microcontrollers, embedded microcontrollers,programmable digital signal processors or other programmable device,along with internal and/or external memory. The processes may also, orinstead, be embodied in an application specific integrated circuit, aprogrammable gate array, programmable array logic, or any other deviceor combination of devices that may be configured to process electronicsignals. It will further be appreciated that one or more of theprocesses may be realized as a computer executable code capable of beingexecuted on a machine-readable medium.

The computer executable code may be created using a structuredprogramming language such as C, an object oriented programming languagesuch as C++, or any other high-level or low-level programming language(including assembly languages, hardware description languages, anddatabase programming languages and technologies) that may be stored,compiled or interpreted to run on one of the above devices, as well asheterogeneous combinations of processors, processor architectures, orcombinations of different hardware and software, or any other machinecapable of executing program instructions.

Thus, in one aspect, each method described above and combinationsthereof may be embodied in computer executable code that, when executingon one or more computing devices, performs the steps thereof. In anotheraspect, the methods may be embodied in systems that perform the stepsthereof, and may be distributed across devices in a number of ways, orall of the functionality may be integrated into a dedicated, standalonedevice or other hardware. In another aspect, the means for performingthe steps associated with the processes described above may include anyof the hardware and/or software described above. All such permutationsand combinations are intended to fall within the scope of the presentdisclosure.

While the invention has been disclosed in connection with the preferredembodiments shown and described in detail, various modifications andimprovements thereon will become readily apparent to those skilled inthe art. Accordingly, the spirit and scope of the present invention isnot to be limited by the foregoing examples, but is to be understood inthe broadest sense allowable by law.

All documents referenced herein are hereby incorporated by reference.

What is claimed is:
 1. A method for managing digital rights management(DRM) protected content sharing in a networked secure collaborativecomputer data exchange environment, the method comprising: establishing,by a secure exchange facility managed by an intermediate organizationalentity, a user login data authentication procedure that allows a userthrough at least one client computing device to access the secureexchange facility, wherein the user is one of a plurality of users of aplurality of other organizational entities that access content sharedthrough the secure exchange facility, where communication between thesecure exchange facility and the plurality of users is through acommunications network; receiving computer data content and at least oneindicator of access rights for the computer data content from a firstuser of the plurality of users associated with a first organizationalentity of the plurality of other organizational entities, wherein thefirst user permits sharing access to the computer data content by atleast a second user of the plurality of users associated with a secondorganizational entity based on the indicated access rights, wherein thesecond organizational entity is one of the plurality of otherorganizational entities and is different than the first organizationalentity; transforming the computer data content into DRM protectedcomputer data content through communications with a DRM engine, whereinthe DRM engine is selected based on a content type of the computer datacontent, and wherein the DRM engine is provided by an entity other thanthe intermediate organizational entity and other than any of theplurality of other organizational entities that access content sharedthrough the secure exchange facility; granting, by the secure exchangefacility, shared access to the DRM protected computer data content to atleast the second user; wherein the secure exchange facility furthercomprises a data management facility and plurality of data storagenodes, wherein the data management facility is managed by theintermediate organizational entity and is adapted to providepermissioned control to the plurality of other organizational entitiesfor use of at least one of the plurality of data storage nodes, whereineach of the other organizational entities is granted permissionedcontrol of at least one of the plurality of data storage nodes by theintermediate organizational entity for storing data comprised of thecontent and metadata, wherein the data management facility managessecure data exchange of the content through the data storage nodes, andwherein the data management facility has access to the metadata of thestored data for managing sharing of the content via the data storagenodes, but the data management facility does not have access to thecontent; and wherein the secure exchange facility provides contentservices to the plurality of data storage nodes that operate on andstore the content, store metadata, and provide at least one of datatransformation, filtering to the content, analytics related to thecontent, and searching tools for the searching for content.
 2. A methodof claim 1, further comprising translating the access rights into a formthat can be parsed by the DRM engine, forwarding, to the DRM engine, thetranslated access rights, and providing, by the DRM engine, thetranslated access rights to at least the second user to enable theshared access to the DRM protected computer data content.
 3. The methodof claim 1, wherein the computer data content is a secure encryptedcomputer data content.
 4. The method of claim 3, wherein at least one ofthe plurality of other organizational entities manages its ownencryption keys for use in encrypting computer data content.
 5. Themethod of claim 4, wherein computer data content is encrypted with adata key, and the data key is encrypted with both a customer key and asystem master key to create double-encrypted computer data content. 6.The method of claim 5, wherein double-encryption of computer datacontent is applied at a plurality of levels of content management. 7.The method of claim 1, further comprising: receiving from the first useran indicator of revision to access rights that revokes sharing access tothe computer data content to at least the second user; wherein thecomputer data content and revised access rights for the computer datacontent are transformed into a revised DRM protected computer datacontent through communications with the DRM engine; and revoking, by thesecure exchange facility, sharing access to the computer data content toat least the second user.
 8. The method of claim 1, wherein the at leastone of data transformation and filtering is at least one ofcontainer-specific, application-specific, and customer-specific.
 9. Themethod of claim 1, further comprising providing a plurality of contentrepositories for storing the computer data content.
 10. The method ofclaim 9, wherein at least one of the plurality of content repositoriesis outside the management of the intermediate organizational entity,wherein collectively the plurality of content repositories including theat least one of the plurality of content repositories outside themanagement of the intermediate organizational entity comprises aplurality of heterogeneous content repositories.
 11. The method of claim10, further comprising providing a secure federated access facility foruniting access to the plurality of heterogeneous content repositoriesthrough a single user interface.
 12. The method of claim 1, furthercomprising receiving second computer data content from the first user,and providing a digital rights authentication service that permits thesecond user to access the computer data content and the second computerdata content upon reception of a single digital rights managementauthentication, thereby enabling the second user to access both computerdata content items without providing authentication for more than one ofthe two computer data content items.
 13. The method of claim 1, furthercomprising providing a secure managed key facility for managingencryption keys used to encrypt the computer data content, wherein thesecure managed key facility generates a content key for encrypting thecomputer data content along with a content key reference, wherein thecontent key reference is stored along with the computer data content,and the content key reference is transferred along with the computerdata content to the second user once shared access is granted.
 14. Themethod of claim 1, further comprising providing a dynamic entitlementmanagement facility, wherein the dynamic entitlement management facilityenables a DRM-based entitlement permission to be dynamically changedbased on a contextual indication.
 15. The method of claim 1, furthercomprising an action checking facility, wherein the action checkingfacility manages actions with respect to an application capabilityresident on the computer device of at least one of the first user andthe second user.
 16. The method of claim 1, further comprising providinga secure mobile device facility to manage a trusted environment policyfor a plurality of mobile devices used by the plurality of users,wherein the plurality of mobile devices are able to securelyinter-communicate with each other within a trusted environment.
 17. Themethod of claim 1, further comprising providing a collaborative customerrelationship management (CRM) facility, wherein the collaborative CRMfacility is used in conjunction with a multi-party collaboration inorder to track contacts and communications of the plurality of users.18. The method of claim 1, further comprising providing a work-streamsynchronization facility, wherein the work-stream synchronizationfacility provides the ability for a secure collaboration container of auser to be synchronized onto a desktop work-stream channel of the user.19. The method of claim 1, further comprising providing a contextualsharing facility, wherein the contextual sharing facility manages thesharing of the computer data content based on the contextual environmentof at least one of the first user and the second user.
 20. The method ofclaim 1, wherein sharing of the computer data content by the first useris restricted based on at least one of the IP address and the domainname associated with the computing device of the first user.
 21. Themethod of claim 1, further comprising application programming interface(API) functionality between the secure exchange facility and theplurality of other organizational entities.
 22. The method of claim 1,wherein the computer data content is encrypted when transferred from acomputer of the first user to the secure exchange facility, transferredwithin the secure exchange facility, stored within the secure exchangefacility, and transferred from the secure exchange facility to acomputer of the second user.